How to see what's inside System Data on a Mac

You cannot click your way into System Data. The grey band in System Settings, General, Storage has no button that lists its contents, so the only honest way to see inside it is to measure the folders it is made of: the data volume at /System/Volumes/Data with du in Terminal, local snapshots with tmutil, swap with sysctl, and the Library folders by hand in Finder. Half an hour and four commands usually name every large resident.

Why won't Storage settings open System Data?

On macOS Ventura and later the storage chart lives under System Settings, General, Storage, and most rows there carry a small information button that lists files you can review or delete. System Data does not. Apple describes it in its own guide to freeing up storage as a general category for Apple and third-party files that do not fit a more specific one, which is another way of saying it holds whatever the chart could not sort. A category built from leftovers has no single folder behind it to open, and that is why the row stays inert however long you look at it. The desk keeps a plain account of what the System Data label means for readers who want the definition first; this page is the practical sequel, the one with commands in it.

Where does System Data actually live on the disk?

Nearly all of it sits on the data volume, the writable half of the APFS pair a recent Mac starts up from. Terminal reaches it at /System/Volumes/Data, and Finder shows the same material through your home folder, the shared Library at the top of the drive and the hidden /private directory. The sealed system volume, the read-only half that holds macOS itself, is counted under its own macOS row, so it can be left out of this search entirely. Inside the data volume, four places account for most of what the chart files under System Data: the Library folder in your home directory, with its caches, logs, containers and application support; the shared /Library beside it; /private/var, home to swap, the sleep image, system logs and the per-user temporary folders under /private/var/folders; and the local Time Machine snapshots that APFS keeps alongside your files without showing them as folders.

How do you list the biggest folders with one Terminal command?

Open Terminal from Applications, Utilities, and run this line, typing your administrator password when asked:

sudo du -xh -d 1 /System/Volumes/Data 2>/dev/null | sort -h

Read it from left to right. du walks the data volume and prints a total for each top-level folder; -d 1 stops it one level down, -h prints sizes in units a person can read, and -x keeps it from wandering into other mounted volumes such as an external drive or an open disk image. The 2>/dev/null part hides the permission complaints that would otherwise fill the window, and sort -h puts the heaviest line at the bottom, right above your cursor. Expect the scan to take a few minutes on a crowded drive. When it finishes, the bottom three lines are your suspects. Run the same command on whichever folder came out heaviest, for example /System/Volumes/Data/private/var or your own ~/Library, and keep descending one level at a time until a name you recognize appears. The desk's walkthrough of the du and df commands covers the flags in more depth, including why du and the Settings chart rarely agree to the gigabyte.

Why do some folders answer Operation not permitted?

macOS guards certain locations behind its privacy controls, the data of Mail, Messages and Safari among them, along with Time Machine material, and those controls still apply when a command runs with sudo. du quietly skips what it cannot read, so totals for those folders come out low. If the numbers look small next to the grey band, open System Settings, Privacy & Security, Full Disk Access, switch Terminal on, then quit and reopen Terminal before scanning again, since the permission does not reach a window that was already open. Switch it off afterwards if you prefer Terminal to stay ordinary: the permission is broad, and a measurement needs it for an afternoon, not for good.

Which residents should you check first?

du finds folders. It does not see snapshots, and it cannot say whether a large folder is safe to touch. Five quick readings fill those gaps, and each one points at a different owner.

Snapshots deserve the first look because they are the resident most likely to explain a sudden jump. If tmutil prints a long list, confirm that your last backup actually finished before doing anything else: snapshots pile up when backups stall, and they leave on their own once a backup completes or the disk needs room. The mechanism, including the rare cases where manual removal is justified, is covered in the guide to how local snapshots thin themselves. Swap comes second. A large vm.swapusage figure after a heavy day is memory accounting, not lost storage, and a restart returns it. Caches and device backups are where deliberate action usually pays, because a single forgotten backup of an old phone can outweigh every cache on the machine. Apple's own route for removing one runs through Finder: select the connected device, open Manage Backups on its General tab, then delete the backup you no longer need.

How do you open the hidden Library folders in Finder?

Terminal is faster, but some readers want to see the folders before trusting a number. In Finder, open the Go menu and hold the Option key: a Library entry appears and opens the Library inside your home folder. Go to Folder, in the same menu, accepts typed paths as well, so ~/Library/Caches or /private/var/vm take you straight to the spot du pointed at. Switch the window to list view, choose View, Show View Options, tick Calculate all sizes, and sort by Size. Finder then ranks the subfolders much as du did, more slowly and with icons. Look, measure, close the window: Library is a place for reading, not for tidying by eye.

What is a normal size for System Data?

There is no published normal. Apple gives no target figure, and none could hold, because the same category swells with snapshot count, memory pressure, application caches and device backups, all of which differ between a student's laptop and an editor's desktop. The useful question is not whether today's number is normal but whether it is moving. Record the System Data figure once a month beside your free-space reading. A band that rises and falls from week to week is a working machine; one that climbs month after month while nothing else changes is the one worth a du session. The best baseline is a reading taken on a quiet day, right after a restart and a completed backup, because swap and snapshots are then at their lowest and what remains is the machine's real resting weight.

What should you leave alone while you look?

Looking costs nothing; deleting inside these folders is where machines get hurt. Leave /System entirely, never delete files from /private/var/vm by hand, and stay out of /private/var/folders, where running applications keep temporary files they expect to find again. Do not remove snapshots just to make a number look better, and never before checking that a backup exists somewhere else. For caches, quit the owning app first, remove modestly, then reopen the app and confirm it still behaves. Readers who would rather touch nothing have a gentler option: Apple notes that starting up in safe mode clears some system caches, font caches and the kernel cache among them, which macOS creates again as needed, and the ordinary restart that follows releases swap. Between those two steps and one completed backup, most of the grey band that can shrink safely will already have shrunk, and whatever is left has a name you can write in the ledger.

Three short questions

Does restarting a Mac reduce System Data?

Often, a little. A restart releases swap, the memory overflow macOS keeps in /private/var/vm, so the band can drop right after boot. It does not touch caches that apps rebuild, device backups, or snapshots waiting for a backup to finish.

Why is the du total smaller than the System Data figure?

Because du cannot see local snapshots, skips folders macOS protects unless Terminal has Full Disk Access, and counts in powers of 1024 while the Settings chart uses decimal gigabytes. Two honest tools can disagree by several gigabytes for those three reasons alone.

Is it safe to give Terminal Full Disk Access?

It is a broad permission: any command run in Terminal can then read protected data such as Mail and Messages. For a measurement session on your own machine that is a reasonable trade, provided you only run commands you understand and switch the permission off when the session ends.