Understanding snapshot data in Disk Utility

Disk Utility version 21.0 in macOS Monterey brings new management features for APFS snapshots. As its Help book doesn’t provide details on the information displayed for snapshots (although there are some clues given in tooltips), this article explains a bit more about what it all means.

diskutil91

Columns available for display, not all shown above, are the following.

XID is the numeric identifier which can be used to identify that snapshot within the parent volume’s namespace. However, it’s not guaranteed to be unique within a container or disk, so its use should be avoided where possible.

UUID is the UUID used to identify each snapshot, and because this is unique, it’s the preferred identifier.

Name is the snapshot name. This is normally prefaced by the identifier of the app that made that snapshot, such as com.apple.TimeMachine for Time Machine, or com.bombich.ccc for Carbon Copy Cloner. Following that is an identifier, which may be another UUID used by the app which created and maintains it, and the date and time it was made. Time Machine also uses an extension to indicate the nature of that snapshot: .local are snapshots made on the volume being backed up as the source, while .backup are those used to build TM backups on the backup disk. This name can be used within the parent volume’s namespace as an identifier, but may not be unique outside that.

Date created gives the date and time at which that snapshot was created.

Tidemark is the highest block referenced by a snapshot. As this can’t be moved, this effectively limits any resizing which might be applied to the container without destroying that snapshot. Values which haven’t changed since the previous snapshot are shown in grey. The Partition symbol is used to mark the high tidemark for that volume, which sets the limit for non-destructive repartitioning of its container.

tidemark

The diagram above may make this clearer. On this volume, current data is shown in black, and snapshot data in grey. The tidemark is the top of the snapshot, and the white (free) space to the right of that shows the unused space which is available for reallocation when changing the partition. The high tidemark is the top of all such individual snapshot tidemarks, and is often the tidemark of the latest snapshot, but may not be.

Private Size is the size of the data only referenced by that snapshot, and is broadly similar to the amount of space which would be recovered if that snapshot were to be deleted.

Size is the cumulative size occupied by that snapshot and all previous snapshots. This reaches a maximum for the latest snapshot. Values which haven’t changed since the previous snapshot are shown in grey.

Kind is currently one of two: Time Machine Snapshot, made by TM on the volume it’s backing up, or copied to the backup store; Snapshot, which was made by any third-party app such as Carbon Copy Cloner.

Here are two examples:

XID 18727
UUID 4F98E87E-2DFF-41A9-B448-D66F4122F1D3
Name com.apple.TimeMachine.2021-06-02-152057.backup
Date created 02/06/2021, 15:20
Tidemark 686.28 GB (at block 167,547,911)
Private size 15.2 MB (15,208,448 bytes)
Size 22.69 GB (22,686,474,240 bytes)
Kind Time Machine Snapshot

XID 213744
UUID C2BF72EB-A6B6-4188-BD5A-5737FBC88C94
Name com.bombich.ccc.17F859C6-0BB0-4601-9F64-0A6EFABCA484.2021-11-09-041500
Date created 09/11/2021, 04:15
Tidemark 1.08 TB (at block 263,387,133)
Private size 37.8 MB (37,761,024 bytes)
Size 130.9 MB (130,908,160 bytes)
Kind Snapshot

Some of this information, but not sizes, is also available in Property List XML format with the command
diskutil apfs listSnapshots -plist [volume]