Home > Apple File System, Mac administration, macOS, Time Machine > Apple software updates creating APFS snapshots on macOS High Sierra

Apple software updates creating APFS snapshots on macOS High Sierra

As part of macOS High Sierra, Apple has added a new feature to Apple software updates which require a restart. When these updates are installed onto a boot drive which is using Apple File System (APFS), an APFS snapshot is automatically created on the boot drive prior to installing the software update. An APFS snapshot is a read-only copy of the state that the boot drive was in at a certain point in time, so it can be used as a backup in case something goes wrong with the update.

Update 11-2-2017: Apple has a KBase article which references this behavior:


The KBase article notes that a snapshot is made before macOS updates are made, which may mean that not all updates that require a restart will generate a snapshot.


In the event that the Apple software update causes post-installation issues, you can boot to Recovery HD and use the Time Machine restore functions available in Recovery to access the snapshot and restore the affected drive to the state it was in before the software update was installed.

Screen Shot 2017 11 01 at 9 37 51 PM

Something to be aware of is that this functionality does not apply to all Apple software updates. Instead, the automated snapshot creation appears to be specifically tied to Apple’s macOS updates.

The automated snapshot creation process does not require Time Machine to be configured for the Mac in question and a separate Time Machine backup drive is not needed. The snapshot is stored on the affected boot drive and does not require anything other than sufficient free space on the boot drive to store the snapshot. For more details, see below the jump.

To demonstrate the behavior, here’s how it would apply to a Mac upgrading from 10.13.0 to 10.13.1. In this case, Time Machine has not been configured on this Mac and no other backup measures are in place.

1. Verify that no APFS snapshots currently exist on the boot drive by opening Terminal and running the following command:

tmutil listlocalsnapshots /

Screen Shot 2017 11 01 at 3 21 14 PM

2. Open the App Store app and run the 10.13.1 update.

Screen Shot 2017 11 01 at 3 34 11 PM

3. After the 10.13.1 update, open Terminal and run the following command:

tmutil listlocalsnapshots /

An APFS snapshot should now appear listed, with a time stamp that coincides with when the 10.13.1 update was run.

Screen Shot 2017 11 01 at 5 00 32 PM

Restoring from a boot drive’s APFS snapshot:

If you need to restore your boot drive from a snapshot, here’s the steps that need to be followed:

1. Boot to Recovery

Screen Shot 2017 11 01 at 9 37 51 PM

2. Select Restore From Time Machine Backup and click the Continue button.

Screen Shot 2017 11 01 at 9 37 57 PM

3. Click Continue

Screen Shot 2017 11 01 at 9 38 06 PM

4. Select your boot drive from the list of available backup sources and click Continue.

Screen Shot 2017 11 01 at 9 39 02 PM

5. Select the relevant local snapshot and click Continue.

Screen Shot 2017 11 01 at 9 39 33 PM

6. When prompted to restore the boot drive from the selected snapshot, click the Continue button.

Screen Shot 2017 11 01 at 9 40 27 PM

7. The restore process will run.

Screen Shot 2017 11 01 at 9 40 31 PM

8. Once the restore process has completed, the Mac will automatically restart.

Screen Shot 2017 11 01 at 9 40 41 PM

After the restart, the Mac should be reverted to the state it was in at the time that the snapshot was created.

Screen Shot 2017 11 01 at 9 42 13 PM

To show what the process looks like when restoring from a snapshot, please see below for a video. In this example, I’m restoring from a snapshot taken as part of the 10.13.1 upgrade process.

Note: The video has been edited to artificially reduce the amount of time the restore and post-restore boot process takes to run. Run time of the pre-edited video was 4 minutes 34 seconds.

Hat tip to @ftiff for documenting how to restore from an APFS snapshot while booted to Recovery.

  1. Snickasaurus
    November 2, 2017 at 12:32 pm

    Thank you for the info

  2. Maurits
    November 2, 2017 at 3:40 pm

    Any idea how long this snapshot is saved? I find that snapshots typically are stored for a few days, not longer.

  3. jbrickley
    November 2, 2017 at 8:24 pm

    Sounds like user data would be lost. Would be nice if Users/ could be snapshot distinctly from the OS. Might require moving /Users to a new APFS Container, mounting Users/ or just symbolic linking the directory. Curious how that would impact snapshots. Are snapshots container specific? Would be neat to rollback an OS snapshot without rolling back user data. Or rolling back user data only.

    • jbrickley
      November 3, 2017 at 6:10 pm

      On second thought, users already peruse Time Machine to recover files but if the whole system is rolled back via snapshot, I guess they lose their stuff within that window as it all resets back to the previous state. That is definitely something to consider…

  4. Samuel A. Litt
    November 9, 2017 at 9:28 pm

    Very cool! Thank you for making the effort to share this with your readers.

  5. January 20, 2018 at 6:38 pm

    Solve this problem:

  6. February 22, 2018 at 3:57 pm

    Reblogged this on [+] Blog del Chote [+].

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: