Restore deleted files on the Mac from Snapshots in Disk Utility

About Snapshots and APFS

Did you accidentally delete or overwrite a file on your Mac? And the last time you made a Time Machine backup was several days ago? Don’t worry. Your Mac keeps local backups and it’s actually quite easy to recover lost files on the Mac.

With macOS High Sierra (10.13) Apple introduced their new filesystem APFS on the Mac. APFS is better optimized for SSDs and generally more reliable and flexible than its decades old predecessor HFS+. The most useful feature, however, are snapshots.

A snapshot basically freezes the state of your disk at a certain moment. A snapshot will initially take up no space. But as you change, add or delete files, it will record the difference to the snapshot state. So each snapshot will take up as much space as you have made changes on the disk since it was taken (or up to the state of the next newer snapshot).

When you have Time Machine enabled, macOS will automtically take snapshots every hour while you use your Mac and keep them for about 24 hours.
You can also create snapshots manually anytime by applying the command tmutil snapshot from the Terminal.

Restoring files from snapshots in Disk Utility

Snapshots are usually invisible. But you can view and manage them in Disk Utility. To do so, select Show APFS Snapshots from the View menu in Disk Utility. (Please note: This feature is only available in macOS Monterey and newer)

When you select your Data volume you will now see a list of all available snapshots and when they were taken.

To browse any snapshots, right click (two finger tap) on it and select Open in Finder.

This will mount the snapshot and directly take you to it in Finder. (Later you can unmount the snapshot with the eject button)

Now you can simply browse your disk as if it were yesterday. You can navigate and preview files just like in any other foder. Only the snapshot is read-only. So once you have found the file you want to restore, you need to copy it to your current disk (simply my moving it to your Desktop for example).

It’s that easy to browse AFPS snapshots and restore lost data even when you forgot to connect your Time Machine backup disk.

Storage Tip

As you might have noticed in Disk Utility, snapshots can take up quite a lot of disk space while you work with large files. You can simply delete all snapshots in Disk Utility with the minus button. This can free up significant amounts of disk space. Of course then you can no longer go back for the moment, but appart from that deleting all snaphsots does not affect your system. Time Machine will soon create new snapshots anyway.