Nico Dudek wrote:1 Hardware swap
2 Installing Catalina new from an earlier created USB Stick/External SSD (with Apple Catalina installer and Qrecall installed) onto the new 1TB new internal iMac disc (in my case it will be a SSD)
3 From the same USB Stick/External SSD I open Qrecall and open the Archive from the external 2TB HFS+ formatted drive and recover the files to the new replaced 1TB new internal iMac disc
I will also note that you can, if you like, flip steps 2 & 3. It's also permissible to format a brand new APFS volume, restore all of
your files to it from the archive, and then install the operating system on top of that (this is actually the technique I use). The install will figure out that macOS has never been installed on this volume, split it, leaving all the files you previously restored on the "data" half of the system/data volume pair.
When I freshly install Catalina on my swapped iMac system HD it is blank without all my programs, that I had installed before. My question: are programs part of the Data so that they are in the found "data" half
Here's the only rule you need to remember: Everything that you, the system, or any other user, writes to your running system volumes resides on the "data" half of the system/data volume pair.
The whole point of having a "system" volume is that
no process is allowed to write to it. Not even processes with super-user privileges. Not even the kernel. Once the macOS installer is finished, the "system" volume is frozen in amber until the next system update.
So if you installed something, it's on the "data" half of your startup volume pair. And it's that "data" volume that QRecall captures.
At run time, the operating system stitches the two together so it
appears to be a single volume. This involves a lot of smoke and mirrors, and can seem pretty crazy at times?at least from the perspective of someone working at the filesystem level ... so almost no one.
As an example, in your Catalina
/Applications folder you have many applications. Some were installed by Apple and some you installed yourself. If you use the low-level filesystem to ask what volume your copy of
/Applications/Mail.app is on, it will tell you that package resides at
/System/Applications/Mail.app. But if you ask it where
/Applications/Photoshop.app resides, it will tell you that package is located at
/System/Volumes/Data/Applications/Photoshop.app. So neither app is actually located at
/Applications. Even stranger, you have a single folder (
/Application) with items that reside on two different filesystems. Like I said, it's pretty crazy.
But the bottom line is that Mail is stored on the immutable "system" volume and cannot be modified/hacked, while Photoshop is on the "data" volume that you can alter and gets captured by QRecall.