Mounting TM Local Snapshots on High Sierra and Beyond
Starting with macOS High Sierra, Time Machine on Apple File System-formatted (APFS) boot drives gained the ability to create APFS snapshots. These snapshots are stored on the boot volume, but are not the same as the local backups that Time Machine uses on HFS+-formatted drives.
On HFS+ formatted drives, Time Machine local backups are stored in an invisible directory named .MobileBackups on the root level of the boot drive.
MTeam7 [~] $ ls -lsa /
total 64K
0 drwxr-xr-x 35 root wheel 1.3K Jul 8 21:04 ./
0 drwxr-xr-x 35 root wheel 1.3K Jul 8 21:04 ../
0 d--x--x--x 9 root wheel 306 Aug 6 22:57 .DocumentRevisions-V100/
0 drwxr-xr-x 2 root wheel 68 Jul 8 20:48 .PKInstallSandboxManager-SystemSoftware/
0 drwx------ 5 root wheel 170 Apr 25 20:22 .Spotlight-V100/
0 d-wx-wx-wt 2 root wheel 68 Jul 26 2017 .Trashes/
0 -rw-r--r-- 1 root wheel 0 Jul 8 21:04 .com.apple.timemachine.supported
0 ---------- 1 root admin 0 Feb 21 2017 .file
0 drwx------ 805 root admin 27K Aug 12 12:10 .fseventsd/
64K -rw------- 1 root wheel 64K Jul 26 2017 .hotfiles.btree
0 drwxr-xr-x 2 root wheel 102 Feb 21 2017 .MobileBackups/
0 drwxr-xr-x 2 root wheel 68 Feb 21 2017 .vol/
0 drwxrwxr-x+ 57 root admin 1.9K Aug 5 14:26 Applications/
This .MobileBackups directory is mountable as /Volumes/MobileBackups and you can access the backed-up files stored inside by navigating via the command line or Finder window.
High Sierra and Up
On APFS-formatted drives, the /.MobileBackups directory and /Volumes/MobileBackups are no longer available. Instead, Time Machine is now using APFS snapshots to store a read-only copy of the state of your Mac at the time when that snapshot was taken.
These snapshots are invisible to the file system, so unlike HFS+, there isn’t a directory or file you can access. Instead, you now need to use the mount_apfs command’s -s option to mount APFS snapshots as read-only volumes.
MOUNT_APFS(8) BSD System Manager's Manual MOUNT_APFS(8)
NAME
mount_apfs -- mount an APFS volume
SYNOPSIS
mount_apfs [-o options] [-u user] [-g group] special directory
mount_apfs [-o options] -s snapshot pathname directory
DESCRIPTION
The mount_apfs command attaches the APFS volume indicated by the device
special to the global file system namespace at the location indicated by
directory. This command is normally executed by diskarbitrationd(8) or
mount(8) at boot time.
The special parameter should be the path to an APFS pseudo disk device
node, such as /dev/disk0s2s1 (which is a volume inside the container
/dev/disk0s2), which can also be specified as simply disk0s2s1.
The options are as follows:
-o options Options passed to mount(2) are specified with the -o option
followed by a comma separated string of options. See the
mount(8) man page for possible options and their meanings.
-u user Set the owner of the files in the file system to user. The
default owner is the owner of the directory on which the
file system is being mounted. The user may be a user-name,
or a numeric value.
-g group Set the group of the files in the file system to group.
The default group is the group of the directory on which
the file system is being mounted. The group may be a
group-name, or a numeric value.
-s snapshot The name of the snapshot to mount. In this usage pathname
is the mounted root directory of the base volume containing
the snapshot.
Mounting the Snapshot
To mount a Time Machine local snapshot as a read-only volume, you will need to first create a directory in a preferred location. This directory will act as the mount point for the snapshot.
For this example, a directory named snapshotbackup will be created in the /tmp directory.
mkdir /snapshotbackup
Next, we need to identify the snapshot we'll mount. The snapshots currently stored on the boot drive can be listed using the following command:
tmutil listlocalsnapshots /
MTeam7 [~] $ tmutil listlocalsnapshots /
com.apple.timemachine.2019-08-10-104212/
com.apple.timemachine.2019-08-10-104214/
com.apple.timemachine.2019-08-10-104215/
com.apple.timemachine.2019-08-10-104216/
For this example, the com.apple.timemachine.2019-08-10-104215 snapshot will be mounted:
mount_apfs -s com.apple.timemachine.2019-08-10-104215 /tmp/snapshotbackup
The snapshot should then mount and appear as a read-only volume in the Finder. To access the snapshot’s contents via the command line, you will need to access it via the mount point. For this example, this means the following directory path:
ls /tmp/snapshotbackup
MTeam7 [~] $ ls -lsa /tmp/snapshotbackup
total 87K
0 drwxr-xr-x 34 root wheel 1.2K Aug 12 15:00 ./
0 drwxr-xr-x 34 root wheel 1.2K Aug 12 15:00 ../
0 d--x--x--x 9 root wheel 306 Aug 6 22:57 .DocumentRevisions-V100/
0 drwxr-xr-x 2 root wheel 68 Jul 8 20:48 .PKInstallSandboxManager-SystemSoftware/
0 drwx------ 5 root wheel 170 Apr 25 20:22 .Spotlight-V100/
0 d-wx-wx-wt 2 root wheel 68 Jul 26 2017 .Trashes/
0 -rw-r--r-- 1 root wheel 0 Jul 8 21:04 .com.apple.timemachine.supported
0 ---------- 1 root admin 0 Feb 21 2017 .file
0 drwx------ 805 root admin 27K Aug 12 12:10 .fseventsd/
64K -rw------- 1 root wheel 64K Jul 26 2017 .hotfiles.btree
0 drwxr-xr-x 2 root wheel 68 Feb 21 2017 .vol/
0 drwxrwxr-x+ 57 root admin 1.9K Aug 5 14:26 Applications/
0 drwxr-xr-x+ 62 root wheel 2.1K Jul 5 21:55 Library/
0 drwxr-xr-x 2 root wheel 68 Dec 31 2000 Network/
0 drwxr-xr-x+ 4 root wheel 136 Jul 8 20:49 System/
0 drwxr-xr-x 5 root admin 170 Dec 31 2000 Users/
0 drwxr-xr-x+ 4 root wheel 136 Aug 11 22:19 Volumes/
0 drwxr-xr-x 38 root wheel 1.3K Jul 8 20:49 bin/
0 drwxrwxr-t 2 root admin 68 Feb 21 2017 cores/
4.5K dr-xr-xr-x 3 root wheel 4.2K Aug 6 19:56 dev/
4.0K lrwxr-xr-x 1 root wheel 11 Dec 31 2000 etc -> private/etc/
1.0K dr-xr-xr-x 2 root wheel 1 Aug 12 02:24 home/
4.0K -rw-r--r-- 1 root wheel 313 Dec 22 2016 installer.failurerequests
1.0K dr-xr-xr-x 2 root wheel 1 Aug 12 02:24 net/
0 drwxr-xr-x 4 root wheel 136 May 7 01:35 opt/
0 drwxr-xr-x 6 root wheel 204 Jul 6 14:51 private/
0 drwxr-xr-x 63 root wheel 2.1K Jul 8 20:49 sbin/
4.0K lrwxr-xr-x 1 root wheel 11 Dec 31 2000 tmp -> private/tmp/
0 drwxr-xr-x 11 root wheel 374 Apr 29 20:38 usr/
4.0K lrwxr-xr-x 1 root wheel 11 Dec 31 2000 var -> private/var/
Unmouting the Snapshot
Once finished with the snapshot, it can be unmounted via the command line or the Finder. To unmount via the command line use "diskutil unmount mountpoint_name_here".
For our example, the following command will unmount the snapshot:
diskutil unmount /tmp/snapshotbackup
{{ 'Comments (%count%)' | trans {count:count} }}
{{ 'Comments are closed.' | trans }}