Last Updated: 2023-08-13


How to find your Home folder

Open Finder, from the top bar: Go -> Home

Use shortcut: Cmd + Shift + H

Add Home to sidebar: top bar Finder -> Preferences... -> Sidebar tab -> tick your home folder

How to Delete Software on macOS

Unlike Windows, there's no Registry in macOS, so programs can be directly deleted.

  • /Applications: software programs, apps can be directly deleted from here
  • /Library and ~/Library: user preferences and resources

How to Page Up or Page Down

Shortcut: fn + up or fn + down

How to Read NTFS Portable HardDrives

Use Paragon NTFS for Mac

How to change default shell

Terminal -> Preferences ... -> General tab -> Shells open with: -> change Command to /bin/bash

How to install software

  • from App Store
  • use a Package manager, e.g. brew

How to record screen

  • Shift + Cmd + 3: take a screenshot of the full screen
  • Shift + Cmd + 4: capture a portion of the screen
  • Shift + Cmd + 5: show the toolbar, which can record videos.

How to disable "XXX(app name) pasted from YYY(mac name)"

System Preferences -> General -> uncheck "Allow Handoff between this Mac and your iCloud devices"

How to check disks?

$ diskutil list

SSD(0) vs HDD(1)

Under the hood


SIP (System Integrity Protection) is enabled by default since El Capitan. It prevents modification of certain files.

$ csrutil status
System Integrity Protection status: enabled.

Wired memory

Critical information stored in RAM by the system, its kernel, and some key application components. This stuff is basically frozen – it allocates its space and never moves to the hard drive or gets replaced with user-level data when RAM becomes scarce. An interesting thing to note about wired memory is that it scales based on how much total system memory is installed. For example, a Mac with 1GB of RAM may show 400MB of wired memory, while a Mac with 4GB of RAM may use 700MB. The more memory you have, the more your Mac wants to use it!

MetaData Framework

Metadata Framework creates index of your content, which enables Spotlight Search (cmd + spacebar).

mds = metadata server

$ ps -e | grep mds

Filesystem: APFS

Apple File System (APFS) allocates disk space on demand.

  • /usr/bin on "Macintosh HD" (a dedicated, read-only system volume)
  • others on "Macintosh HD - Data" (your files and data)
  • use firmlinks to stitch them up.

Firmlinks: Bi-directional wormhole in path traversal

  • Consistent forward and backward traversal of the file name space
  • Only for directories
  • Created on the system volume at installation time
  • Not expected to be noticed by a user or an application

If you run df you may find something like /dev/disk1s1.

Naming convention: diskCsVsS

  • C is an APFS Container. This is a virtual disk constructed by APFS to represent a collection of APFS Volumes. Multiple APFS Containers can be active simultaneously.
  • V is an APFS Volume; it refers to a virtual logical volume that is shared out of an APFS Container.
  • S is an APFS Snapshot; it refers to a frozen moment in time of the state of files on an APFS Volume.

Apple Open Directory

LDAP directory service


Directory Structure

Hierarchical File System


  • System domain: low level stuff, installed by Apple. Under /System
  • Local domain: shared by all users.
  • User domain: user specific, under /Users/username


  • /System/Applications: applications pre-installed by Apple
  • /Applications:
  • /Users/username/Applications (~/Applications)

e.g. Xcode Dev Tools: /Applications/Xcode.app/Contents/Developer/usr/bin


There are 3 Library folders:

  • System Library: /System/Library
  • Local Library: /Library
  • User Library: ~/Library

e.g. Java:

  • /System/Library/Frameworks/JavaVM.framework/Versions/Current
  • /Library/Java/JavaVirtualMachines


(Since Catalina) macOS has a read-only system volume and a read-write user volume interleaved on a folder by folder basis using firmlinks.

  • /Volumes: your hard drive is mounted here
  • /System/Volumes/VM: virtual memory
  • /System/Volumes/Preboot
  • /System/Volumes/Data
  • /System/Volumes/Recovery


$ sudo rm -rf ~/.Trash/*

Core Dumps

The /cores folder is where macOS stores Core Dumps. These are files that are intended for developers to trouble-shoot and diagnose faults in their software.

POSIX directories

  • /bin, /sbin: commands
  • /dev: devices
  • /etc: configurations
  • /tmp: temporary files
  • /usr:
  • /var: e.g. log files
  • /opt: optional, not part of a unix distribution. E.g. homebrew is under /opt/homebrew

macOS Commands and Binaries


List the contents of an installer's bom (bill of materials) file. This can be used to find out what files an installer will add / replace in your system before running it. It can also list details of a previous install.

$ lsbom -fls  /private/var/db/receipts/org.macports.MacPorts.bom | (cd /; sudo xargs rm)


$ diskutil apfs list


launchd, PID=1: systemd equivelent in macOS.

kernel_task: PID 0

macOS missing commands

  • tree. To install: $ brew install tree

Apple Silicon

Check if your software is ready for Apple silicon: https://isapplesiliconready.com/

Rosetta 2: announced in 2020, to aid in the Mac transition to Apple silicon. The software permits many applications compiled exclusively for execution on x86-64-based processors to be translated for execution on Apple silicon.

Universal 2 binary format: also introduced in 2020, allows applications to run on both Intel x86-64-based and ARM64-based Macintosh computers, to enable the transition to Apple silicon.

(Why 2? 1 was for transition from PowerPC to Intel)