Archive for the ‘Time Machine’ Category

Creating, managing and using Apple File System snapshots for startup drive backups

May 8, 2019 5 comments

Starting with macOS High Sierra, Time Machine on Apple File System-formatted (APFS) startup drives gained the ability to create APFS snapshots. These snapshots capture the state of the startup volume at a particular point in time and can be used by Time Machine to restore files, folders or the whole startup volume. These snapshots are stored on the startup volume, but are not the same as the previous local backups that Time Machine used on Hierarchical File System Plus (HFS+) formatted drives.

On HFS+ formatted drives, Time Machine local backups are stored in an invisible directory named .MobileBackups on the root level of the startup drive.

Figure 1 Location of the MobileBackups directory on an HFS+ formatted boot drive

This .MobileBackups directory is mountable as /Volumes/MobileBackups and you can access the backed-up files stored inside by navigating via the command line or Finder window.

Figure 2 Navigating the mounted MobileBackups volume

On APFS formatted drives, the /.MobileBackups directory and /Volumes/MobileBackups are no longer available. Instead, Time Machine is now using APFS snapshots to store a read-only copy of the state of your Mac’s startup drive at the time when that snapshot was taken. These snapshots are invisible to the file system, so unlike HFS+, there isn’t a directory or file location which you can access to get access to the snapshot-stored backups.

Snapshots include all files and directories stored on the startup drive at the time that the individual snapshot was made. When available, these snapshots can be used to restore the following:

  • Individual files
  • Individual directories
  • Multiple files at once
  • Multiple directories at once
  • All files and directories at once

If the startup drive was encrypted at the time the snapshot was made, the snapshot will itself be encrypted. This allows the restoration of an encrypted startup drive without needing to decrypt or re-encrypt the relevant startup drive. For more details, please see below the jump.

Read more…

Mounting Time Machine local snapshots as read-only volumes

February 23, 2019 4 comments

Starting with macOS High Sierra, Time Machine on Apple File System-formatted (APFS) boot drives gained the ability to create APFS snapshots. These snapshots are stored on the boot volume, but are not the same as the local backups that Time Machine uses on HFS+-formatted drives.

On HFS+ formatted drives, Time Machine local backups are stored in an invisible directory named .MobileBackups on the root level of the boot drive.

Screen Shot 2019 02 23 at 10 44 17 AM

In turn, this .MobileBackups directory is mountable as /Volumes/MobileBackups and you can access the backed-up files stored inside by navigating via the command line or Finder window.

Screen Shot 2019 02 23 at 10 59 43 AM

On APFS-formatted drives, the /.MobileBackups directory and /Volumes/MobileBackups are no longer available. Instead, Time Machine is now using APFS snapshots to store a read-only copy of the state of your Mac at the time when that snapshot was taken. These snapshots are invisible to the file system, so unlike HFS+, there isn’t a directory or file you can access. Instead, you now need to use the mount_apfs command’s -s option to mount APFS snapshots as read-only volumes.

Screen Shot 2019 02 23 at 11 45 51 AM

For more details, please see below the jump.

Read more…

Apple software updates creating APFS snapshots on macOS High Sierra

November 2, 2017 7 comments

As part of macOS High Sierra, Apple has added a new feature to Apple software updates which require a restart. When these updates are installed onto a boot drive which is using Apple File System (APFS), an APFS snapshot is automatically created on the boot drive prior to installing the software update. An APFS snapshot is a read-only copy of the state that the boot drive was in at a certain point in time, so it can be used as a backup in case something goes wrong with the update.

Update 11-2-2017: Apple has a KBase article which references this behavior:

The KBase article notes that a snapshot is made before macOS updates are made, which may mean that not all updates that require a restart will generate a snapshot.


In the event that the Apple software update causes post-installation issues, you can boot to Recovery HD and use the Time Machine restore functions available in Recovery to access the snapshot and restore the affected drive to the state it was in before the software update was installed.

Screen Shot 2017 11 01 at 9 37 51 PM

Something to be aware of is that this functionality does not apply to all Apple software updates. Instead, the automated snapshot creation appears to be specifically tied to Apple’s macOS updates.

The automated snapshot creation process does not require Time Machine to be configured for the Mac in question and a separate Time Machine backup drive is not needed. The snapshot is stored on the affected boot drive and does not require anything other than sufficient free space on the boot drive to store the snapshot. For more details, see below the jump.

Read more…

Backups, backups….how do you trust them when you need them?

March 28, 2010 1 comment

Since starting my current job around seven years ago, I’ve become a tithing member of the Church of Backups. I helped build backup systems for my office, transitioned from different backup systems to others, and am in the process of transitioning from one system of backing up desktops to another. I also have set up backups for my home and other members of the family. Along the way, I’ve learned a few lessons, so I’ll list them in order of importance to me:

1. Make your backup system as automated as possible – if you’re having to start something manually for your backup to run, you’ll forget to do it on a regular basis. We’re all busy and have a lot of things competing for our attention. Make running your backup be something that’s handled by something that Just Works.

2. Test your backup – if you can’t restore, you don’t have a backup and have spent money, time and energy on something that will be a failure when you need it most. With that in mind, isn’t a little testing worth the time? The only way to find that out how good your backup really is, is to do a restore and see what you have. Testing and finding failures is not a bad thing, it just means you have a chance to fix what’s wrong before you need that backup for real.

3. Check that the backup is actually running properly – Along with the backup that Just Works, have another automated process that’s notifying you regularly that It’s Working. If that’s not possible, add checking your backups to your weekly to-do list.

4. If possible, get a block-level backup solution – At the heart of it, there’s two different kinds of backups. The first is a file-level backup, which tracks and backs up entire files. (On the Mac side, both Retrospect and Time Machine do file-level backups.) The second is a block-level backup, which tracks and backs up files based on how their blocks have changed on the drive level. (on the Mac side, Mozy, CrashPlan and many other Internet backup services work this way.)

Why I prefer a block level solution is that it allows better efficiency in how your backup storage is used and also allows you to back up large files without having to repeatedly recopy the whole large file into your backups. Also, block-level backups are generally better at backing up large files while they’re in use.

Restoring Mac OS X Server from Time Machine

March 2, 2010 9 comments

If you’re running Mac OS X Server 10.5.x or higher, you may be backing it up with Time Machine. However, Time Machine has gotten a bad reputation with some admins because of what Time Machine *doesn’t* back up. That being said, since Time Machine saved my bacon this past weekend, I wanted to post a Time Machine restoration how-to that (depending on your configuration) can be a lifesaver for your Mac or XServe running Mac OS X Server.

To recover the system:

1. Connect the Time Machine backup disk to the server (should already be connected, but double-check.)

If you’re restoring your system because of a problem with the startup disk, make sure the disk has been repaired or replaced.

2. Insert your Mac OS X Server Install disk, and boot from the installer disk.

3. In the Installer, choose Utilities > Restore System from Backup.

4. In the Restore Your System dialog, click Continue.

5. Select your Time Machine backup volume.

6. Select the Time Machine backup you want to restore.

7. Follow the onscreen instructions.

YouTube video showing the recovery process:

Following a Time Machine restore:

Recreate folders that are not included in the Time Machine backup as described below.

Open Terminal (in /Applications/Utilities).
Execute these commands, each on its own line, followed by Return. Note: When using these commands you will be prompted for an administrator’s password.

sudo mkdir /var/log
sudo mkdir /var/log/apache2
sudo mkdir /var/log/samba
sudo mkdir /var/log/swupd
sudo touch /var/log/daily.out
sudo touch /var/log/weekly.out
sudo touch /var/log/monthly.out

To restore the Wiki service (server), run the following commands in addition to those above:

sudo mkdir /Library/Logs/wikid
sudo chown _teamsserver:_teamsserver /Library/Logs/wikid

To restore the Mail service, execute the following command:

sudo /etc/postfix/post-install create-missing

After running these commands, restart the server.

Exceptions to the rule:

Databases – Time Machine is a file-based backup, and doesn’t handle backing up active databases that well. However, it does a good job of backing up database backup files. If you’re running a database on your server (and you are if the server is an Open Directory Master, as OD works from an LDAP database), make sure to set up an automated process that automatically backs up your database to the appropriate backup file (varies by database) on a regular basis.

Mail – On 10.5 Server (I don’t know about 10.6.x Server), Time Machine does not back up the /private/var/spool directory. As a result, nothing in /private/var/spool or the directories inside spool are backed up. This is important for those running a mail server because /private/var/spool/imap which is where IMAP users’ E-mail is stored.

If you’re using Time Machine to back up a 10.5.x server where you’re also running mail services, I recommend that you go to /System/Library/CoreServices/backupd.bundle/Contents/Resources/StdExclusions.plist and comment out the /private/var/spool exclusion using the following:

<!– /private/var/spool –>

Network Time Machine backups on 10.6.x

November 11, 2009 Leave a comment

One of the nice things about 10.6 is how much better Time Machine backups perform. I’d had set up Time Machine on 10.5 to back up to an Time Machine AFP share, which was hosted from one of my home 10.5 servers. Performance was not great, and I had issues with Finder occasionally beachballing or being herky-jerky while Time Machine was making a backup. Eventually, I turned Time Machine backups off and resorted to backing up my account’s home folder with rsync, using RipCord.

When I upgraded to 10.6, I decided to give network Time Machine backups another try, and I’m glad that I did. Once Time Machine did the first backup (which ran overnight, due to the fact that it was backing up 50 GBs over a WiFi network), Time Machine has behaved very smoothly and most of the time I don’t even notice that it’s done a backup until after the fact.

How to do a full Time Machine system restore without being booted from an install DVD

March 13, 2009 6 comments

Recently, I found that I needed to do a full system restore on a late-model MacBook Pro, but didn’t have a 10.5 install DVD available that would boot the laptop. I did have a FireWire utility drive that’s updated to 10.5.6, which would boot the laptop, but there is no obvious way to run the “Restore System from Backup” utility without being booted from an install DVD.

Thanks to “seibert” on the PGP forums, it looks like there is a way to run a system restore without needing to be booted from the 10.5 install DVD (though you’ll still need to have one available.) Here’s the procedure:

1. Boot your Mac with a drive that has 10.5.x installed. This volume cannot be the target volume when you restore from Time Machine later.

2. Attach your Time Machine drive or volume.

3. Insert the 10.5 install DVD.

4. Open the Terminal and run the following command:

sudo “/Volumes/Mac OS X Install Disc 1/System/Installation/CDIS/Mac OS X OS X Installer” “/Volumes/Mac OS X Install Disc 1/System/Installation/Packages/OSInstall.mpkg”

You may need to replace “Mac OS X Install Disc 1” with whatever the name of your Leopard installer DVD is. Mine came with my MacBook, so it has this name because there are two disks. sudo is required because the Installer needs root permissions to be be able to set permissions on the target volume when you perform the restoration.

5. The installer will show the usual Leopard installation screen, which you can ignore. Go to the Utilities menu and select “Restore System from Backup”. Follow instructions as you usually would for a Time Machine restore.

“Seibert”‘s procedure was designed for use with a PGP encrypted drive, but this should work with both encrypted and unencrypted Macs.

New backup drive for the Mini home theater.

December 28, 2008 Leave a comment

I’ve got a Mac Mini that I use as the base for my home theater setup, which I’ve been backing up with Time Machine. In the past few months, I’ve noticed that Time Machine has been keeping backups less than a month, which was tied back to the fact that I’ve been using a 300 GB external drive to back up an internal 80 gig drive and another 300 GB external drive. Neither drive being backed up was full yet, but the math looked pretty clear: having 300 gigs available to back up 380 gigs of potential used space is a pretty bad proposition.

To fix that, I went to Best Buy this weekend and picked up a new quad-interface 500 GB Iomega UltraMax hard drive. So far, no problems and I’ll hopefully be good for another year of worry-free backups.

Categories: Geeky, Mac OS X, Time Machine

Web sharing not working after a Time Machine restore?

March 19, 2008 1 comment

I ran into an issue yesterday, following a full restore of the boot drive of my home theater’s Mac Mini. I had the idea that I could turn my Mini into an actual server, using OS X Server 10.5.2, while still having it do all of the Front Row duties it’s currently doing. It turned out I was wrong (apparently, Front Row on Mac OS X Server 10.5.2 doesn’t want to talk with the latest iTunes), so I used Time Machine to roll back my boot drive to Mac OS X 10.5.2. Everything looks like it’s working fine, until I turn on web sharing and I can’t connect via HTTP to my video files. (When I’m away from my house and off my local subnet, I like to be able to stream the MP4 videos in my iTunes collection to my iPhone and laptop using HTTP and Quicktime.)

Long story short, Apache 2 (the web server built into 10.5) was fine, Time Machine just hadn’t backed something up. In fact, Time Machine by default doesn’t back up a lot of stuff that Apple knows can be rebuilt pretty easily (either automatically or manually.) Here’s the exclusions list currently for Time Machine:

Globally, the following files are excluded: /Volumes, /Network, /automount, /.vol, /tmp, /cores, /private/tmp, /private/Network, /private/tftpboot, /private/var/automount, /private/var/log, /private/var/folders, /private/var/log/apache2, /private/var/log/cups, /private/var/log/fax, /private/var/log/ppp, /private/var/log/sa, /private/var/log/samba, /private/var/log/uucp, /private/var/run, /private/var/spool, /private/var/tmp, /private/var/vm, /private/var/db/dhcpclient, /private/var/db/fseventsd, /Library/Caches, /Library/Logs, /System/Library/Caches, /System/Library/Extensions/Caches, the files and folders /.Spotlight-V100, /.Trashes, /.fseventsd, /.hotfiles.btree, /Backups.backupdb, /Desktop DB, /Desktop DF, /Network/Servers, /Previous Systems, /Users/Shared/SC Info, /Users/Guest, /dev, /home, /net, /private/var/db/Spotlight, /private/var/db/Spotlight-V100

For each user account, the following files are excluded: Library/Application Support/MobileSync, Library/Application Support/SyncServices, Library/Caches, Library/Logs, Library/Mail/Envelope Index, Library/Mail/AvailableFeeds, Library/Mirrors, Library/PubSub/Database, Library/PubSub/Downloads, Library/PubSub/Feeds, Library/Safari/Icons.db, Library/Safari/

Fascinating, right? Well, as it turns out, one of the folders excluded is /private/var/log/apache2, otherwise known as the folder where Apache 2 sticks the error and access logs. That folder isn’t regenerated automatically by the system or by Apache either, but Apache needs to have that folder present in order to run. The fix is pretty simple – create the folder with the following command in Terminal: sudo mkdir /private/var/log/apache2

Categories: Geeky, Mac OS X, Time Machine
%d bloggers like this: