When Apple announced APFS at WWDC ten years ago, snapshots were demonstrated as one of its major features, and intended to form the basis of Time Machine’s backups in the future. Shortly after its initial release in High Sierra, Rich Trouton at Der Flounder documented their use, including how to roll back to a snapshot using Time Machine System Restore in Recovery mode. Apple described this in a support note now replaced by its successor, last revised six months ago, which carefully avoids any mention of rollback.

Snapshots are widely available in modern file systems, in some being referred to as shadow copies, and rolling back to them is a popular if not indispensable feature. Except in APFS, where there appears to be only one supported method, which is severely restricted, as I described last week. That enables you to roll back your Mac’s current Data volume to a snapshot, but doesn’t work for any other volume as far as I can discover.

Disk Utility can display and delete snapshots on any mounted disk, but can’t create or roll back to them. Its command line equivalent diskutil has the same limits (unless you’re ChatGPT). tmutil appears to be the only way to create a snapshot in macOS, but can’t perform that for an arbitrary volume, only the current Data volume and those being backed up by Time Machine.

If I wanted to make a one-off snapshot of a volume on an external SSD, I’d thus have to turn to a third-party utility. Even here I’m up against Apple again, as the API for snapshots is controlled by two restricted entitlements, com.apple.developer.vfs.snapshot for creating and deleting them, and com.apple.private.apfs.revert-to-snapshot for rollback. So far, Apple appears to have approved only apps that make backups and automatically delete their old snapshots to prevent them from overwhelming storage space, and I’m not aware of one with the com.apple.private.apfs.revert-to-snapshot entitlement to allow rollback.

As Adam Leventhal has documented in his open source command tool snaputil, the API call fs_snapshot_revert() is used to perform a rollback, but without the com.apple.private.apfs.revert-to-snapshot entitlement is non-functional.

Having drawn a blank with Apple’s tools, you might feel tempted to ask AI to help. If you’re lucky it might talk you through using Time Machine System Restore in Recovery mode, although as we’ve seen that can’t help with any volume other than the current Data volume.

ChatGPT’s responses to two queries from different people are more concerning, as it repeatedly asserted that you can roll back using a completely imaginary verb with the diskutil command, in one case using a command of the form
diskutil apfs revertToSnapshot -n com.apple.TimeMachine.YYYY-MM-DD-HHMMSS /
or using
diskutil apfs revertToSnapshot disk1s5 -n com.apple.TimeMachine.YYYY-MM-DD-HHMMSS
instead.

I have checked that in normal user mode and in Recovery mode, only to be told the revertToSnapshot verb isn’t recognised. With the aid of virtual machines, I’ve confirmed that as far back as macOS 12 Monterey, and there’s absolutely no sign of it. When challenged, ChatGPT maintained that it was “directionally right” that revert capability exists in APFS, as we already know from Time Machine System Restore, and that Apple’s entitlement structure “proves it”. It’s a shame I had to do so much checking to confirm that ChatGPT was plain wrong, and had apparently made up those commands.

Not being able to make a one-off snapshot of a volume on an external SSD might appear a small if annoying oversight, but it has consequences. Snapshots are not only blazingly quick in rollback, but they are also the only means of restoring some important volume content, such as document versions, which is easily demonstrated.

When files are restored by copying from a mounted snapshot, all their saved versions are lost. They are also lost from Time Machine backups, and in any case would be lost during migration. The only way to preserve those versions would be using a third-party tool such as my Versatility or Revisionist.

Ten years after Apple first promised us snapshots in APFS, we still don’t have access to their full capabilities, and their use remains largely undocumented. Yet they’re readily available in competing operating systems and file systems.

There are often times when a laptop Mac has to be separated from its backup storage. This article explains how you can use local snapshots to cover those, and roll back to a snapshot in the event of a problem.

Snapshots are one of the most valuable features new to APFS. In the days of HFS+, Time Machine offered something similar that required around 10,000 lines of code, and still wasn’t as good as a real snapshot. Although they’re no substitute for a proper backup on a separate disk, snapshots can get you out of a hole when nothing else will.

A snapshot is simply a copy of the file system for a single volume at a moment in time. The file system data itself is relatively small, but to ensure your Mac can roll back to that, it has to retain changed and deleted storage from that moment on, and that makes increasing demands on space. So you only want to keep snapshots for the shortest time necessary, or they can quickly consume tens and even hundreds of GB.

If you want to restore just part of a snapshot, you can mount it as a volume in the Finder and copy the folders and files you need from there, as if it was a backup. This article considers how you can address a bigger problem, where your best choice is to return the whole of your Mac’s Data volume to how it was when a snapshot was made.

Make a snapshot

The essential ingredient is, of course, a snapshot. If your laptop Mac is already making Time Machine backups, when its backup storage isn’t available it should continue making snapshots instead of full backups, so you’re covered.

You don’t need to be using Time Machine to make a snapshot of your current Data volume, though. Any Mac will make one when you enter the command in Terminal
tmutil snapshot

Although third-party backup utilities can also make snapshots, you may well find they don’t work with Apple’s rollback feature, and should check with their documentation before relying on them.

Roll back

To roll back your current Data volume to a previous snapshot, first check in Disk Utility that the snapshot you intend to use is still available, if necessary using the command Show APFS Snapshots in its View menu when the Data volume is selected. That will list all those available.

Then shut your Mac down and start it up in Recovery mode, passing through to the main window in Recovery Assistant.

Select the top item to Restore from Time Machine, and click Continue.

Click Continue to move past its opening window.

Select the boot volume group here, normally named Macintosh HD, then Continue.

You’ll then be offered the list of available snapshots. If you don’t see any here, then I’m afraid you’re out of luck, and won’t be able to roll back using Time Machine System Restore. Click Continue.

Check in this warning dialog that you’re going to roll back to the correct snapshot, then click Continue.

The rollback takes but the twinkling of an eye, following which your Mac will automatically restart back into normal user mode, with the snapshot contents as its Data volume. If you made the snapshot yourself in Terminal, Terminal will still be open, displaying that command, just as it was when you made that snapshot.

The only side-effect to be aware of is that all snapshots made after the one you rolled back to have now vanished, and can’t be retrieved. That’s because you have effectively forked the file system from the moment of the snapshot you have rolled back to, and more recent snapshots can’t fit in with the changes made by the rollback.

Finally, I have heard of commands that are claimed to perform rollbacks, including one for diskutil apfs. I believe those to be bogus. As far as I’m aware, Terminal in Recovery doesn’t offer a command tool to perform snapshot rollbacks, but I’ll be happy to be proved wrong.

Key points

• Use a Time Machine snapshot, or tmutil snapshot in Terminal.
• Roll back in Recovery, using Time Machine System Restore.
• Rolling back is almost instant, but deletes all later snapshots automatically.