How macOS actually works

The vocabulary, defined

Updated 2026-07-31 · 4 min read

Every term in these articles, defined once, plainly.

Storage and files

APFS — the modern Mac filesystem. Containers share space, files clone cheaply, snapshots freeze states.

Volume — a mountable filesystem. One drive can hold several; each has its own search index.

Package / bundle — a folder shown as one item (.app, .photoslibrary). Search indexes it as a single object, not its contents.

inode / file ID — the filesystem's identity for a file, stable across renames within a volume.

Firmlink — the APFS join stitching the read-only System volume and your Data volume into one apparent tree.

Search machinery

Index — a prepared copy of what you will search, so lookups skip the disk.

Spotlight — macOS's built-in content-and-metadata index and search.

mdfind / mdls / mdimport / mdutil — the Terminal tools for querying, inspecting, importing and managing the Spotlight index.

FSEvents — the macOS API reporting filesystem changes, letting an index stay current without rescanning.

Content search vs filename search — searching inside files (expensive, what Spotlight excels at) versus matching names (cheap, what a filename index excels at).

Permissions

SIP (System Integrity Protection) — kernel-level immutability for system files; root cannot override it.

TCC / Full Disk Access — the privacy layer gating access to personal data like Mail and Messages until an app is granted permission.

Quarantine — the attribute on downloaded files triggering Gatekeeper's first-open check.

Sandbox — the confinement every Mac App Store app runs under, unable to read your filesystem freely.

Metadata

Extended attributes (xattr) — hidden key-value data on files: tags, download origins, quarantine flags.

UTI (Uniform Type Identifier) — the file's real type, independent of its extension. Finder's Kind filter uses it.

Metadata — data about a file (size, dates, type, tags) as distinct from its contents.

Common questions

What is the difference between content search and filename search?

Content search matches text inside files — expensive, Spotlight's strength. Filename search matches names — cheap, and what a dedicated index does instantly.

What does TCC stand for on a Mac?

Transparency, Consent and Control — the privacy system behind Full Disk Access and the permission prompts.