In last week’s Explainer on snapshots, I stated that “you can safely remove all Time Machine snapshots from that volume except the most recent, which is also the smallest.” This article explains the reasoning behind that.

Why delete snapshots?

Time Machine and other backup utilities make local snapshots on the volumes they back up in addition to copying all changes to backup storage, normally on a different device like an external disk. Because of that, local snapshots are a bonus not a backup. When a volume being backed up is running short of free space, one good method of freeing up space is therefore to delete some of those local snapshots.

Sometimes deleting just one snapshot can free up a lot of space, but estimating the amount likely to be returned is complicated, and to a degree not always readily predictable. If you know one of those snapshots has retained a very large file like a VM or macOS update, you may be able to get away with just deleting the single snapshot, but it’s more usual to need to delete as many as possible, typically just keeping one.

If you are going to retain one snapshot, then by far the smallest is likely to be the most recent, as that almost invariably contains the fewest changes from the current contents of the volume. The oldest snapshot is almost certain to contain much greater changes, so deleting it normally returns the greatest free space. So in terms of meeting your goal of freeing up space, the best strategy is to delete all snapshots except the most recent.

Why keep snapshots?

Although a bonus, a local snapshot is valuable if something goes wrong with a volume and its backup isn’t readily available, either because it’s in a different location or there’s a problem with backup storage. In those circumstances you’re most likely to want that snapshot to be the most recent made, rather than the oldest. So in terms of justifying the retention of any snapshot, the best strategy is to retain the most recent.

What does Time Machine use snapshots for?

Before APFS, Time Machine made the closest it could come to snapshots in HFS+ only when it was unable to perform a scheduled backup. That typically happened on Macs remote from their backup storage, and was intended as the best possible substitute for a proper backup. When Apple introduced APFS in macOS High Sierra, it explicitly stated how its snapshot feature would spare Time Machine from having to run its own code to imitate that.

In High Sierra and Mojave, Time Machine relied on snapshots to determine what needed to be backed up from an APFS volume. It made a snapshot at the start of each backup, and compared that with the snapshot made with the previous backup, a process known as snapshot diffing, and used those differences to determine what should be backed up. That relies on keeping the snapshot made at the time of the last backup; if that’s unavailable, Time Machine has to use another method, and in many cases ends up backing up a lot more than is necessary.

One major disadvantage of snapshot diffing is that it requires the snapshot made for the last backup to be retained until the next backup can be made. When backups are made regularly every hour, that was acceptable, but a Mac that couldn’t back up for several days could end up with an old snapshot occupying tens of GB. Since macOS Catalina Time Machine has therefore been relying on an older method, introduced with HFS+, using the FSEvents database maintained on each volume. That doesn’t require snapshots at all.

Currently, Time Machine will therefore use FSEvents to determine what needs to be backed up from each volume, but there are occasions when that isn’t possible, for example when that database becomes damaged. If that happens, and the snapshot made at the time of the last backup is available, then Time Machine may decide to use snapshot diffing. If that’s not possible, it may fall back to performing a much larger backup than is necessary.

To enable snapshot diffing to take place if needed, Macs that make regular hourly backups should retain their most recent local snapshot.

That becomes complicated and unpredictable in the case of Macs that may skip regular backups, so some snapshots match backups but others don’t. This is confounded by the rule applied for automatic deletion of local snapshots when they are more than 24 hours old, unless that snapshot is the last on that volume. Without matching each snapshot to its backup (or lack of backup), you can’t know which might need to be retained in case Time Machine needs to use snapshot diffing to determine what should be backed up in the future. Whatever you decide to do, if you delete any local snapshots there’s a risk that might result in the next backup being larger than necessary. But the chances are that Time Machine will still be able to use FSEvents rather than snapshot diffing.

Other backup utilities

Time Machine appears to be the only backup utility that can use snapshot diffing to determine what should be backed up. You should therefore be able to delete local snapshots made by other backup utilities without any penalty. If in any doubt, consult their documentation.

Conclusion

If you need to delete local snapshots to free up space in a volume, you can safely delete all except the most recent snapshot, when each snapshot is accompanied by a backup. Where some backups may have been skipped, that is still likely to prove the best overall strategy.