Explainer: Snapshots

Snapshots are one of the most powerful and useful features of APFS, which simply weren’t possible in HFS+. You’ll sometimes see older accounts of Time Machine referring to its backups as snapshots, which they aren’t, or those made by Mobile Time Machine, which were something more similar.

A snapshot, as the name implies, is an image made of the file system of an APFS volume at a moment in time. This consists of all the internal directory and other filesystem data, collectively known as the file system metadata. On their own, they’re of limited value, but what happens next transforms them.

Once you’ve made a snapshot of a volume, all the old file data which is associated with it is preserved. When a file is changed in APFS, the data isn’t changed in place in that same storage block, as APFS uses a scheme called copy on write to protect that data, so changed data is written out to a new block. Ordinarily, in the absence of snapshots, the old block is then returned to the pool of free blocks, so that it will eventually be erased and re-used for storage. When there’s a snapshot, though, those old blocks are retained and not erased or freed.

This means that, if you access files through the snapshot, they remain exactly as they were when that snapshot was made, using a combination of old blocks (for those which have since changed) and active blocks (for those which haven’t changed).

The snapshot itself, the file system metadata at its heart, isn’t stored in an APFS volume, which is just the current file system, but within its container. The data blocks which contain its files are scattered through that container’s storage area, where they share space with other volumes within that container.

Over time, as more blocks are replaced by changed ones in the volume, the number retained for storage of old file data rises. In the extreme, if you keep a snapshot long enough, the whole volume will have changed, in which case the effective size of the data in that snapshot is the same as that volume when the snapshot was originally made. This makes snapshot maintenance very important.

The file system in a snapshot is treated as being read-only and can’t be changed. This makes it particularly suitable for the Sealed System Volume in Big Sur, for example.

When used for Time Machine backups, snapshots are near-perfect. When your Mac used to back up to an HFS+ disk, that was actually a single partition containing one file system. Every time that a backup was made, vast numbers of hard links to files and folders were added to that file system. After a few months of use, it could readily contain many millions of hard links and files, all within the same file system, making it prone to errors even when it was journalled.

When each backup is made into its own snapshot, it is its own file system, and never grows when more backups are added. This ensures that each snapshot file system has a fixed size, and remains easily manageable. Once made and checked, that snapshot can’t be changed, so there’s no scope for errors developing as more files are added to it (as they can’t be).

The problems with snapshots arise because of the limited tools which can deal with them. They can be checked, using either the First Aid tool in Disk Utility or its command line equivalent fsck_apfs. You can also mount them as if they were removable volumes, which enables their contents to be viewed and copied, but not altered in any way. If you prefer, you can roll back that whole volume to its state as recorded in the snapshot, but once you’ve done that, you can’t roll forward again, as all newer data is destroyed in that process.

You also can’t copy or move that snapshot from its original disk. You could perhaps mount a snapshot, and make a copy of that as a volume, but you can’t turn that back into the snapshot it was, or assemble multiple snapshots into a copy of your backup snapshots. There’s no reason why Apple couldn’t provide tools to do any of those things, but for the present it doesn’t.

Apple strictly limits those third-party apps which are given access to the snapshot features in macOS, and all of those at present are some form of backup utility, like Carbon Copy Cloner and SuperDuper! Carbon Copy Cloner is particularly useful for managing snapshots, including those made by Time Machine itself, as well as those it creates.