{"id":56681,"date":"2019-12-11T09:13:49","date_gmt":"2019-12-11T15:13:49","guid":{"rendered":"https:\/\/eshop.macsales.com\/blog\/?p=56681"},"modified":"2019-12-13T10:45:38","modified_gmt":"2019-12-13T16:45:38","slug":"working-with-macos-snapshots","status":"publish","type":"post","link":"https:\/\/eshop.macsales.com\/blog\/56681-working-with-macos-snapshots\/","title":{"rendered":"Working with macOS Snapshots"},"content":{"rendered":"\n

Snapshots are a feature of APFS (Apple File System) that has been part of the macOS since High Sierra. A snapshot captures the state of an APFS formatted drive<\/a>, and preserves all the files on the drive, as they appeared when the snapshot was taken. If you ever need to, you can roll back the drive to its previous state.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Apple makes use of the snapshot feature whenever a system update is performed. Before the system update is applied, a snapshot is taken of the startup drive, ensuring that if something goes wrong with the update process, you could recover from the problem quickly and be back right where you were before you started the system update.<\/p>\n\n\n\n

In this Rocket Yard guide, we’re going to take a look at APFS<\/a> snapshots, how they\u2019re created, managed, and deleted, as well as the advantages and disadvantages of snapshots. <\/p>\n\n\n\n

Snapshots Take Up No Space, But Can Magnify the Amount of Data Blocks Used<\/h3>\n\n\n\n

When a snapshot is initially created, it takes up no additional space on the volume. A snapshot essentially marks all the currently used data blocks on a volume to be preserved; that is, no changes can be made to them. At the moment a snapshot is taken, there\u2019s no increase in the space used on a volume.<\/p>\n\n\n\n

Note<\/em><\/strong>: Apple has supported local snapshots<\/a> on HFS+ formatted drives since OS X Lion. APFS-based snapshots use an entirely different mechanism even though Apple has continued to use the “local snapshot” nomenclature for both types of file system snapshots. In this guide, we\u2019re specifically dealing with the APFS snapshots.<\/p>\n\n\n\n

\"Time
Time Machine can create and manage APFS snapshots for you.<\/figcaption><\/figure><\/div>\n\n\n\n

Snapshots leverage the APFS’s copy-on-write system. When there\u2019s a need to write data, such as when you\u2019re editing a file, a new data block is used to hold the changes you\u2019re making, instead of writing the data back to the original block.<\/p>\n\n\n\n

Normally the old data block can then be marked as free and available for use. However, if the block is marked as preserved, such as when a snapshot has been generated, the old block remains and is not freed up for use.<\/p>\n\n\n\n

Editing a file can significantly magnify the amount of space being used, as the old versions of the file are retained in the snapshot, while outright deleting a file frees up no space at all since the snapshot will retain all the preserved data.<\/p>\n\n\n\n

Creating a Snapshot and Rolling Back a Snapshot is Fast<\/h3>\n\n\n\n

A big advantage to snapshots is how quickly they can be created. Only the volume\u2019s metadata is being copied, so the process is lightning-fast, especially when compared against conventional backups. Rolling back to a snapshot is also quick; just the metadata needs to be restored since all the actual information in a snapshot data block was never changed.<\/p>\n\n\n\n

Deleting a Snapshot is Difficult<\/h3>\n\n\n\n

Unwinding a snapshot can be a difficult process, as the system needs to go through each data block and remove the preserved setting, decide if the data block still contains active information, and free up the data blocks that aren\u2019t currently in use where it can.<\/p>\n\n\n\n

Snapshots Are Not Backups<\/h3>\n\n\n\n

On the surface, it looks like snapshots perform the same function as a backup, but have the added advantage of being quick and easy to create, as well as providing the ability to use a snapshot to recover from a problem quickly.<\/p>\n\n\n\n

Seems pretty good, but snapshots have a few downsides. First up, snapshots are part of the startup drive. They don\u2019t exist anywhere but on the same startup drive as the data<\/g> you\u2019re trying to protect. That makes snapshots vulnerable to any issues the volume may encounter. Accidently erase the startup drive and the snapshot is gone as well. Drive having some type of errors? The snapshot is likely experiencing<\/g> the same problem. The point being, don\u2019t rely on snapshots as a backup. You still need a dedicated backup<\/a> that keeps data stored on a physically separate device.<\/p>\n\n\n\n

Creating Snapshots<\/h3>\n\n\n\n

APFS snapshots are only supported on drives using the APFS format. If you\u2019re using any other file system, such as HFS+, APFS snapshots will not be available. If you\u2019re using a drive with APFS, you have a few options available for creating and managing snapshots.<\/p>\n\n\n\n

\"Terminal
Terminal can be used with the tmutil command to create snapshots.<\/figcaption><\/figure><\/div>\n\n\n\n

Time Machine:<\/strong> Time Machine<\/a> gained support for APFS snapshots with macOS High Sierra. Some sharp-eyed Time Machine users may have noticed an addition to the description of the types of data Time Machine keeps. When you open the Time Machine preference pane, you\u2019ll see “Local snapshots as space permits” is now part of the description of what Time Machine does.<\/p>\n\n\n\n

Time Machine will use APFS snapshots of your startup drive provided it\u2019s APFS formatted, isn\u2019t in Time Machine\u2019s list of excluded items, and there\u2019s a significant amount of free space available.<\/p>\n\n\n\n

Time Machine performs the following snapshot management functions:<\/p>\n\n\n\n