Illustration for How to Restore Files from an APFS Snapshot on a Mac

How to Restore Files from an APFS Snapshot on a Mac

Published by
Illustration for How to Restore Files from an APFS Snapshot on a Mac

An APFS snapshot is a read-only record of a Mac volume at a specific time. If a file was changed, moved, or deleted after a snapshot was created, you may be able to copy its earlier version from that snapshot without restoring the entire Mac.

The easiest method is to use macOS Recovery and Time Machine when the snapshot belongs to a Time Machine backup. For local APFS snapshots on your Mac’s internal drive, you can also locate and mount a snapshot in Terminal, then copy files from it in Finder.

Quick Answer

To restore files from an APFS snapshot:

  1. Start the Mac in macOS Recovery. 2. Open Disk Utility and confirm the relevant APFS volume is available. 3. If the snapshot is part of a Time Machine backup, choose Restore from Time Machine and select the needed backup date. 4.

What Is an APFS Snapshot?

APFS, or Apple File System, can create snapshots that preserve the state of a volume at a particular moment. A snapshot is not a complete second copy of every file. Instead, it records the earlier structure and uses the original data blocks that remain unchanged.

Snapshots can be created by:

  • Time Machine, as part of a backup process
  • macOS system processes, especially before certain system updates
  • Third-party backup software
  • Manual Terminal commands

A snapshot is useful when you need an earlier version of a file or want to recover a recently deleted item. It is not a substitute for a separate backup because snapshots generally remain on the same physical storage device. If the drive fails, its snapshots may become inaccessible too.

For broader information about identifying APFS volumes and containers, see how to check APFS containers and volumes in Terminal on a Mac.

Before You Restore Anything

Before opening or copying data from a snapshot, keep these points in mind:

  • Do not save recovered files back to the same location if the original file is still there. Copy them to another folder, an external drive, or another volume first.
  • Do not erase or reformat the source drive. That can remove the snapshot and make recovery impossible.
  • Do not replace a newer file immediately. Save the older version under a different name so you can compare both versions.
  • Make sure you have enough free space for the restored files.
  • If you are about to restart, enter macOS Recovery, or run a command that may unmount a volume, save your work and close open apps first.

If the snapshot is on an external drive, keep the drive connected directly to the Mac whenever possible. Avoid hubs or adapters that disconnect unexpectedly.

Method 1: Restore from a Time Machine Snapshot

Use this method when the APFS snapshot was created by Time Machine or when the files are available through a Time Machine backup disk.

Time Machine provides a graphical interface for browsing earlier versions of files. It is usually the safest option for beginners because it handles the snapshot and backup structure for you.

Enter Time Machine from macOS

  1. Connect the Time Machine backup disk if your backup is stored on an external drive.
  2. Open System Settings.
  3. Select General, then Time Machine.
  4. Choose Options or the available option to browse backups, depending on your macOS version and configuration.
  5. Open the Time Machine browsing interface.
  6. Use the timeline or on-screen controls to select a date before the file was changed or deleted.
  7. Open the folder that contained the file.
  8. Select the file and click Restore.

The restored item normally returns to its original location. If a file with the same name already exists, macOS may ask whether you want to keep both files, stop, or replace the newer item. To avoid losing the newer version, choose the option that keeps both files when it is available.

Restore through macOS Recovery

If the Mac will not start normally, or you need to restore files from a backup before reinstalling macOS, use Recovery:

  1. Shut down the Mac.
  2. Start macOS Recovery:
    – On a Mac with Apple silicon, press and hold the power button until startup options appear, then choose Options.
    – On an Intel-based Mac, turn it on and immediately hold Command-R until the Apple logo or a spinning globe appears.
  3. Select an administrator account if prompted, then enter its password.
  4. In the Recovery window, choose Restore from Time Machine.
  5. Follow the onscreen instructions to choose the backup disk and date.
  6. Select the files or system state you want to restore.

Warning: A full Time Machine restoration can replace the contents of the destination system volume. If you only need a few files, use the regular Time Machine interface when possible instead of restoring the entire Mac.

Method 2: Mount a Local APFS Snapshot in Terminal

This method is useful when you need to inspect local snapshots on an APFS volume and copy individual files manually. It requires an administrator password and careful attention to the volume identifier and snapshot date.

List available APFS snapshots

  1. Open Terminal from Applications > Utilities.
  2. List APFS volumes:
diskutil apfs list

This command only displays information. It does not change the disk.

  1. Find the APFS volume that contains the files. Look for a volume identifier in a format similar to disk3s1.
  2. List snapshots for that volume, replacing disk3s1 with the correct identifier:
diskutil apfs listSnapshots disk3s1

You may see snapshot names and dates. A typical snapshot name may look similar to:

com.apple.TimeMachine.2025-01-15-120000.local

The exact names vary. Identify a snapshot created before the file was changed or deleted.

Mount the snapshot

Use the snapshot UUID or name shown by the previous command. The syntax can vary by macOS version, so first check the built-in help:

diskutil apfs help

On systems that support direct snapshot mounting, the command generally follows this pattern:

sudo diskutil apfs mountSnapshot disk3s1 -s SNAPSHOT-UUID

Replace:

  • disk3s1 with the correct APFS volume identifier
  • SNAPSHOT-UUID with the snapshot identifier shown by listSnapshots

The command may ask for your administrator password. Terminal does not display characters while you type the password; press Return when finished.

If the command succeeds, macOS should mount the snapshot and report a location. Open that location in Finder, then browse to the original folder and locate the earlier file.

Important: The mounted snapshot is read-only. You should copy files from it rather than attempting to edit or save files inside it.

Copy the restored file

You can use Finder:

  1. Open the mounted snapshot location.
  2. Navigate to the folder containing the file.
  3. Control-click the file and choose Copy.
  4. Open a destination folder on another volume or in your current home folder.
  5. Control-click an empty area and choose Paste Item.

You can also copy a file with Terminal. For example:

cp "/Volumes/SnapshotName/Users/yourname/Documents/old-file.docx" "$HOME/Desktop/"

This command copies the file to your Desktop. Change both paths to match your snapshot and file.

If a path contains spaces, keep the quotation marks. The cp command creates a copy and leaves the original snapshot unchanged.

For a folder and its contents, use:

cp -R "/Volumes/SnapshotName/Users/yourname/Documents/Old Folder" "$HOME/Desktop/"

The -R option tells cp to copy a folder recursively. Check the destination afterward to confirm that the restored data is complete.

Unmount the snapshot

When you finish, unmount the snapshot from Finder by clicking the Eject icon next to it in the sidebar. You can also use Terminal:

diskutil unmount "/Volumes/SnapshotName"

Replace SnapshotName with the mounted volume’s actual name.

Unmounting does not delete the snapshot. It only disconnects the mounted view from Finder. If you want to remove a local snapshot later, do not do so until you are certain that you no longer need it and have a separate backup.

Method 3: Use a Snapshot-Aware Backup App

Some backup applications create APFS snapshots or provide their own snapshot browser. If the snapshot was created by a third-party tool, use that app’s restore function rather than trying to mount it manually.

A backup app may require you to:

  1. Open the backup application.
  2. Select the source volume or backup set.
  3. Choose a snapshot date.
  4. Browse to the required file.
  5. Select a separate destination.
  6. Start the restore.

Read the app’s instructions before confirming a full-volume restore. Some restore tools can replace existing files without offering an easy undo option.

Restoring Files from an External APFS Drive

If the snapshot is on an external APFS drive:

  1. Connect the drive directly to the Mac.
  2. Wait for it to appear in Finder.
  3. Open Disk Utility and choose View > Show All Devices.
  4. Confirm that the external volume is listed and mounted.
  5. Use Time Machine, the backup app that created the snapshot, or Terminal to locate the snapshot.
  6. Copy restored files to the Mac’s internal storage or another reliable backup destination.

Do not use Erase or Partition in Disk Utility while attempting recovery. Those actions can destroy the volume and its snapshots.

If the external drive keeps disappearing, stabilize the connection before attempting recovery. Try another cable, port, power adapter, or direct connection. You can also review how to fix an external drive that keeps disconnecting from a Mac.

Troubleshooting

No snapshots are listed

Run the command against the correct APFS volume. A Mac can contain several APFS volumes, including system, data, recovery, and virtual-machine volumes.

Use:

diskutil apfs list

Then run diskutil apfs listSnapshots with the identifier for the volume that actually held the files.

There may also be no snapshots because:

  • Automatic snapshot creation was disabled.
  • The snapshots were deleted to free space.
  • The volume is not APFS.
  • The snapshot belongs to a backup application rather than the selected volume.
  • The snapshot is on a disconnected external disk.

The snapshot will not mount

Confirm that you used the snapshot identifier exactly as displayed. Also check that the source volume is unlocked and mounted.

If the volume is encrypted, macOS may require an administrator password or the password for the volume owner. Do not guess repeatedly if you are unsure of the password; verify that you selected the correct volume.

A snapshot may also be unavailable if the volume has file-system damage. In that case, avoid making changes to the drive and consider creating a byte-for-byte backup or consulting a professional data-recovery service.

The restored file is not in the expected folder

The snapshot may represent a different volume than the one you expected. On newer Mac installations, user files are generally stored on a Data volume while the system itself uses a separate System volume.

Check the path under:

/Users/yourname/

Also search by filename in Finder after mounting the snapshot. Look in common folders such as Documents, Desktop, Downloads, Pictures, and application-specific folders.

The file opens as damaged or incomplete

The snapshot may have been created while the file was being written, or the file may depend on related files that were not restored. For example, a project file may require a separate media folder or library.

Try an earlier or later snapshot. Restore the entire containing folder when the application uses multiple supporting files, and keep the restored copy separate from the current version.

There is not enough free space

Restore only the required files, or choose a different destination with more available storage. Do not delete snapshots until you have confirmed that the recovered files open correctly and exist in a separate backup.

The original file was deleted a long time ago

APFS snapshots are not permanent archives. macOS or backup software may remove older snapshots as storage space becomes limited. If no suitable snapshot remains, try a Time Machine backup or another backup source.

For a deleted file on an external drive, a separate recovery process may be necessary. See how to recover deleted files from an external drive on a Mac.

Frequently Asked Questions

Can I restore one file without restoring the entire Mac?

Yes. If you can browse the snapshot or Time Machine backup, copy the individual file or folder to a separate location. A full system restoration is not required for a single file.

Are APFS snapshots the same as backups?

No. A snapshot is usually stored on the same physical drive as the original volume.

Can I edit files inside an APFS snapshot?

No. APFS snapshots are read-only. Copy the file to a writable location before opening or editing it.

Will mounting a snapshot change my files?

Mounting a snapshot should not change the original files because the snapshot is read-only.

Can I delete an APFS snapshot after recovery?

You can remove snapshots in some situations, but do not delete one until you have confirmed that the restored files are complete and backed up elsewhere. If the snapshot is managed by Time Machine or backup software, use that software to manage it.

Final Thoughts

APFS snapshots can provide a practical way to retrieve an earlier file without restoring an entire Mac. Start with Time Machine when available.