Mounting Time Machine local snapshots as read-only volumes

Starting with macOS High Sierra, Time Machine on Apple File System-formatted (APFS) boot drives gained the ability to create APFS snapshots. These snapshots are stored on the boot volume, but are not the same as the local backups that Time Machine uses on HFS+-formatted drives.

On HFS+ formatted drives, Time Machine local backups are stored in an invisible directory named .MobileBackups on the root level of the boot drive.

In turn, this .MobileBackups directory is mountable as /Volumes/MobileBackups and you can access the backed-up files stored inside by navigating via the command line or Finder window.

On APFS-formatted drives, the /.MobileBackups directory and /Volumes/MobileBackups are no longer available. Instead, Time Machine is now using APFS snapshots to store a read-only copy of the state of your Mac at the time when that snapshot was taken. These snapshots are invisible to the file system, so unlike HFS+, there isn’t a directory or file you can access. Instead, you now need to use the mount_apfs command’s -s option to mount APFS snapshots as read-only volumes.

For more details, please see below the jump.

To mount a Time Machine local snapshot as a read-only volume, you will need to first create a directory in a preferred location. This directory will act as the mount point for the snapshot.

For this example, a directory named snapshotbackup will be created in the /tmp directory.

Next, the snapshot to mount must be identified. The snapshots currently stored on the boot drive can be listed using the following command:

tmutil listlocalsnapshots /

 

For this example, the following snapshot will be used:

com.apple.TimeMachine.2019-02-23-102421

 

Once the mount point and snapshot have been identified, a command similar to the one shown below should mount the snapshot:

mount_apfs -s snapshot_name_here backed_up_volume_name_here mountpoint_name_here

For this example, the command should look like this:

mount_apfs -s com.apple.TimeMachine.2019-02-23-102421 / /tmp/snapshotbackup

The snapshot should then mount and appear as a read-only volume in the Finder.

To access the snapshot’s contents via the command line, you will need to access it via the mount point. For this example, this means the following directory path:

/tmp/snapshotbackup

 

Once finished with the snapshot, it can be unmounted via the command line or the Finder. To unmount via the command line, a command similar to the one shown below should unmount the snapshot:

diskutil unmount mountpoint_name_here

For our example, the following command will unmount the snapshot:

diskutil unmount /tmp/snapshotbackup