Mounting TM Local Snapshots on High Sierra and Beyond

Starting with macOS High Sierra, Time Machine on Apple File System-formatted (APFS) boot drives gained the ability to create APFS snapshots. These snapshots are stored on the boot volume, but are not the same as the local backups that Time Machine uses on HFS+-formatted drives.

On HFS+ formatted drives, Time Machine local backups are stored in an invisible directory named .MobileBackups on the root level of the boot drive.

  MTeam7 [~] $ ls -lsa /
total 64K
   0 drwxr-xr-x   35 root  wheel 1.3K Jul  8 21:04 ./
   0 drwxr-xr-x   35 root  wheel 1.3K Jul  8 21:04 ../
   0 d--x--x--x    9 root  wheel  306 Aug  6 22:57 .DocumentRevisions-V100/
   0 drwxr-xr-x    2 root  wheel   68 Jul  8 20:48 .PKInstallSandboxManager-SystemSoftware/
   0 drwx------    5 root  wheel  170 Apr 25 20:22 .Spotlight-V100/
   0 d-wx-wx-wt    2 root  wheel   68 Jul 26  2017 .Trashes/
   0 -rw-r--r--    1 root  wheel    0 Jul  8 21:04 .com.apple.timemachine.supported
   0 ----------    1 root  admin    0 Feb 21  2017 .file
   0 drwx------  805 root  admin  27K Aug 12 12:10 .fseventsd/
 64K -rw-------    1 root  wheel  64K Jul 26  2017 .hotfiles.btree
   0 drwxr-xr-x    2 root  wheel  102 Feb 21  2017 .MobileBackups/
   0 drwxr-xr-x    2 root  wheel   68 Feb 21  2017 .vol/
   0 drwxrwxr-x+  57 root  admin 1.9K Aug  5 14:26 Applications/

This .MobileBackups directory is mountable as /Volumes/MobileBackups and you can access the backed-up files stored inside by navigating via the command line or Finder window.

High Sierra and Up

On APFS-formatted drives, the /.MobileBackups directory and /Volumes/MobileBackups are no longer available. Instead, Time Machine is now using APFS snapshots to store a read-only copy of the state of your Mac at the time when that snapshot was taken.

These snapshots are invisible to the file system, so unlike HFS+, there isn’t a directory or file you can access. Instead, you now need to use the mount_apfs command’s -s option to mount APFS snapshots as read-only volumes.

MOUNT_APFS(8)             BSD System Manager's Manual            MOUNT_APFS(8)

NAME
     mount_apfs -- mount an APFS volume

SYNOPSIS
     mount_apfs [-o options] [-u user] [-g group] special directory
     mount_apfs [-o options] -s snapshot pathname directory

DESCRIPTION
     The mount_apfs command attaches the APFS volume indicated by the device
     special to the global file system namespace at the location indicated by
     directory.  This command is normally executed by diskarbitrationd(8) or
     mount(8) at boot time.

     The special parameter should be the path to an APFS pseudo disk device
     node, such as /dev/disk0s2s1 (which is a volume inside the container
     /dev/disk0s2), which can also be specified as simply disk0s2s1.

     The options are as follows:

     -o options    Options passed to mount(2) are specified with the -o option
                   followed by a comma separated string of options. See the
                   mount(8) man page for possible options and their meanings.

     -u user       Set the owner of the files in the file system to user.  The
                   default owner is the owner of the directory on which the
                   file system is being mounted.  The user may be a user-name,
                   or a numeric value.

     -g group      Set the group of the files in the file system to group.
                   The default group is the group of the directory on which
                   the file system is being mounted.  The group may be a
                   group-name, or a numeric value.

     -s snapshot   The name of the snapshot to mount.  In this usage pathname 
                   is the mounted root directory of the base volume containing 
                   the snapshot.

Mounting the Snapshot

To mount a Time Machine local snapshot as a read-only volume, you will need to first create a directory in a preferred location. This directory will act as the mount point for the snapshot.

For this example, a directory named snapshotbackup will be created in the /tmp directory.

mkdir /snapshotbackup

Next, we need to identify the snapshot we'll mount. The snapshots currently stored on the boot drive can be listed using the following command:

tmutil listlocalsnapshots /

  MTeam7 [~] $ tmutil listlocalsnapshots /
com.apple.timemachine.2019-08-10-104212/
com.apple.timemachine.2019-08-10-104214/
com.apple.timemachine.2019-08-10-104215/
com.apple.timemachine.2019-08-10-104216/

For this example, the com.apple.timemachine.2019-08-10-104215 snapshot will be mounted:

mount_apfs -s com.apple.timemachine.2019-08-10-104215 /tmp/snapshotbackup

The snapshot should then mount and appear as a read-only volume in the Finder. To access the snapshot’s contents via the command line, you will need to access it via the mount point. For this example, this means the following directory path:

ls /tmp/snapshotbackup

  MTeam7 [~] $ ls -lsa /tmp/snapshotbackup
total 87K
   0 drwxr-xr-x   34 root  wheel 1.2K Aug 12 15:00 ./
   0 drwxr-xr-x   34 root  wheel 1.2K Aug 12 15:00 ../
   0 d--x--x--x    9 root  wheel  306 Aug  6 22:57 .DocumentRevisions-V100/
   0 drwxr-xr-x    2 root  wheel   68 Jul  8 20:48 .PKInstallSandboxManager-SystemSoftware/
   0 drwx------    5 root  wheel  170 Apr 25 20:22 .Spotlight-V100/
   0 d-wx-wx-wt    2 root  wheel   68 Jul 26  2017 .Trashes/
   0 -rw-r--r--    1 root  wheel    0 Jul  8 21:04 .com.apple.timemachine.supported
   0 ----------    1 root  admin    0 Feb 21  2017 .file
   0 drwx------  805 root  admin  27K Aug 12 12:10 .fseventsd/
 64K -rw-------    1 root  wheel  64K Jul 26  2017 .hotfiles.btree
   0 drwxr-xr-x    2 root  wheel   68 Feb 21  2017 .vol/
   0 drwxrwxr-x+  57 root  admin 1.9K Aug  5 14:26 Applications/
   0 drwxr-xr-x+  62 root  wheel 2.1K Jul  5 21:55 Library/
   0 drwxr-xr-x    2 root  wheel   68 Dec 31  2000 Network/
   0 drwxr-xr-x+   4 root  wheel  136 Jul  8 20:49 System/
   0 drwxr-xr-x    5 root  admin  170 Dec 31  2000 Users/
   0 drwxr-xr-x+   4 root  wheel  136 Aug 11 22:19 Volumes/
   0 drwxr-xr-x   38 root  wheel 1.3K Jul  8 20:49 bin/
   0 drwxrwxr-t    2 root  admin   68 Feb 21  2017 cores/
4.5K dr-xr-xr-x    3 root  wheel 4.2K Aug  6 19:56 dev/
4.0K lrwxr-xr-x    1 root  wheel   11 Dec 31  2000 etc -> private/etc/
1.0K dr-xr-xr-x    2 root  wheel    1 Aug 12 02:24 home/
4.0K -rw-r--r--    1 root  wheel  313 Dec 22  2016 installer.failurerequests
1.0K dr-xr-xr-x    2 root  wheel    1 Aug 12 02:24 net/
   0 drwxr-xr-x    4 root  wheel  136 May  7 01:35 opt/
   0 drwxr-xr-x    6 root  wheel  204 Jul  6 14:51 private/
   0 drwxr-xr-x   63 root  wheel 2.1K Jul  8 20:49 sbin/
4.0K lrwxr-xr-x    1 root  wheel   11 Dec 31  2000 tmp -> private/tmp/
   0 drwxr-xr-x   11 root  wheel  374 Apr 29 20:38 usr/
4.0K lrwxr-xr-x    1 root  wheel   11 Dec 31  2000 var -> private/var/

Unmouting the Snapshot

Once finished with the snapshot, it can be unmounted via the command line or the Finder. To unmount via the command line use "diskutil unmount mountpoint_name_here".

For our example, the following command will unmount the snapshot:

diskutil unmount /tmp/snapshotbackup