APFS Local Snapshots — Ventura change! (Cool Recovery tool! OS 10.13 & later)

[mikehalloran]

See my last post for an important change that affects Ventura.

I changed the title to be a bit better and have added a new post about single file/folder restore.

AFIK, all USB Monitors use DisplayLink Drivers. These do not yet work with the official High Sierra 10.13.4—6 release (10.13.3 is fine as will 10.14 when it ships). Check this site before updating.

http://www.displaylink.com/downloads/macos

If you didn't know this before updating the OS. High Sierra has a very interesting shortcut to a full restore. Boot into Recovery mode holding the Command r keys and selected Recover from Time Machine Backup. OK...

What was different is that I found an icon with my boot drive listed. Curious, I opened it using my Admin password. I saw the last two days of Time Machine backups and they listed the OS. I double-clicked on one from yesterday that listed 10.13.3 and within 15 seconds, my system was fully restored.

This only works on an SSD formatted APFS — not HHDs or Fusion Drives.

Option Boot cannot see the Recovery partition with APFS, only Command r and it will launch into an older Recovery partition if present. For that reason, it won't work if any other OS or recovery drive is visible.

Dual-boot drives are not recommended with High Sierra. You can have a dual-boot system using external drives (as I do) but they must be turned off before you attempt Recovery Mode in High Sierra with APFS.

Since un-delete doesn't work and utilities that claim to recover files on SSDs are useless, you can recover individual files and folders! Enter Time Machine, go to the directory and scroll back an hour or two to recover — much faster.

All Snapshots have a maximum 24 hour recovery window. Miss that and you're recovering from Time Machine the old way. If your SSD is too full, you might not have the full 24 hours.

Instant Time Machine Restore for system and files. I so like that.

[bayswater]

15 seconds?!?!

I assume this feature is not "official" in any way. Could disappear without notice?

[mikehalloran]

15 seconds?!?!

I assume this feature is not "official" in any way. Could disappear without notice?

APFS is weird and Apple hasn't written the white paper on it. With SSDs, partitions aren't mapped to physical locations but APFS takes that into the Twilight Zone. Partitions are virtual and that allows some interesting and bizarre features.

One of the features is that APFS takes snapshots. I stumbled into it and got lucky but this is known. Turns out you can also create them manually.
https://www.lifewire.com/roll-back-apfs ... ts-4154969

Good article except it doesn't give the caution that having any other OS available won''r allow Command r to work.

[bayswater]

From the article, it sure looks like a real feature. I've been wondering why Apple made it so difficult to revert to earlier OS versions, and it looks like they're solving that problem.

My understanding is that snapshots have always been a part of the TM backup process, but maybe they haven't been so easily accessible.

One question that comes up: this process uses TM, so you'd want to know, if you don't have TM options set to back up the entire startup SSD, would a snapshot cover the entire SSD?

[Phil O]

Boot into Recovery mode holding the Command r keys and selected Recover from Time Machine Backup.

There's also option-command-r and shift-option-command-r:

https://support.apple.com/en-us/HT204904

I know these work in earlier versions of OS, but I haven't tried them with Sierra/High Sierra.

Phil

[mikehalloran]

From the article, it sure looks like a real feature. I've been wondering why Apple made it so difficult to revert to earlier OS versions, and it looks like they're solving that problem.

My understanding is that snapshots have always been a part of the TM backup process, but maybe they haven't been so easily accessible.

Yes, if you are going to restore a folder or file, you access the snapshots but those are stored on your TM drive and it takes awhile to find and navigate to the one you need—those won't restore your whole system. This is way different.

One question that comes up: this process uses TM, so you'd want to know, if you don't have TM options set to back up the entire startup SSD, would a snapshot cover the entire SSD?

"Starting with macOS High Sierra, Apple is using snapshots to create a backup point that would allow you to recover from an operating system upgrade that went wrong, or just return to the previous version of the macOS if you decided you didn’t like the upgrade.

In either case, the rollback to the saved snapshot state does not require you to reinstall the old OS or even restore information from backups you may have created in Time Machine or third-party backup apps.

...

Although Time Machine utility is used, you do not have to have Time Machine setup or have it being used for backups, though it is not a bad idea to have an effective backup system in place."

[mikehalloran]

There's also option-command-r and shift-option-command-r:

https://support.apple.com/en-us/HT204904

I know these work in earlier versions of OS, but I haven't tried them with Sierra/High Sierra.

Phil

High Sierra is different. There is no Repair Partition for you to chose by holding the Option key on startup. Command r on startup is how you get there and no other OS or earlier Repair Partition can be present or it will boot into those instead.

option-command-r and shift-option-command-r give you the following

Starting Internet Recovery
This may take awhile

[Phil O]

Thanks for the clarification on that, Mike. Good stuff to know!

[mikehalloran]

Yesterday, I was doing a bit of cleanup and deleted 5 instances of a very old file when I thought I had 6—oops, I only had 5. No problem, I got this.

Trash recovery doesn't work on SSDs but that's ok—I know how to do a Time Machine Recovery on single files and folders. So I did the normal routine, navigated to one of the directories where that folder used to reside, went to Time Machine and selected Enter Time Machine and holy cow ...

Instead of waiting many minutes for Snapshots of pages to display so I could scroll back, it was nearly instantaneous with a timeline displayed to the right. I clicked on a random time from the day before, saw the folder, clicked on it to Restore, OK and bingo, I was done. If you discount the time I spent being amazed at the speed, it was probably 10 seconds total. Factor another minute of me thinking, Can it really be this fast?

This is the way that Snapshots has always worked with Time Machine but there's a major difference: Because High Sierra over APFS stores 24 hours of Local Snapshots on your SSD, no time is spent logging into your backups and waiting (and waiting and waiting...) for those pages to load.

Oh, I am liking this big time!

A few things: For Local Snapshots to be stored on your drive, there has to be available space. If you need to go back more than 24 hours, you'll be querying your TM backup drives and that will not be quick. Indexing is not used for this task but to Search for a file on Time Machine, Indexing needs to be on.

[bayswater]

Instead of waiting many minutes for Snapshots of pages to display so I could scroll back, it was nearly instantaneous with a timeline displayed to the right. I clicked on a random time from the day before, saw the folder, clicked on it to Restore, OK and bingo, I was done. If you discount the time I spent being amazed at the speed, it was probably 10 seconds total. Factor another minute of me thinking, Can it really be this fast?

Thanks for bringing this forward. I tried it with a file deleted a few days ago. It works! And it's fast!

Something I noticed when trying this out: I have a lot of stuff excluded from TM backups. Desktop for example. I only keep temporary stuff there so saw no need to back it up. Applications. I have nothing I can't reinstall. But when I go into TM, all the stuff on my Desktop and Applications folders are there going back for a long time. My test above was from the Desktop folder which is theory is not backed up. What might be going on here?

[mikehalloran]

When I had to do a system restore last week, I went through booting into the Repair Partition and was ready to log into one of by TM drives when I noticed that one of my options was my boot SSD — I'd never seen that before. The rest is as I explained it in the OP.

APFS Local Snapshots appear to be of the entire drive and independent of Time Machine backups — even though you use the Time Machine utility to access them. That article I pointed to earlier said as much although it didn't go into any detail. As was also mentioned in that article, when you run out of drive space to store them, the older ones fall off the grid.

As Apple has yet to write a white paper or guide to the practical applications of APFS, so much of this is a mystery. We know that, with an SSD, erased data is gone and that, between TRIM and garbage collection, there's no way to get it back through Trash Recovery, right? Uh huh... So, how come APFS Snapshots are able to completely restore an SSD instantly to a prior state as long as it isn't very old?

I went into the App Store and saw all of these updates waiting. But waitaminute, I installed all of these on 4/6... Oh yea... so I re-ran all except the 10.13.4 updater because of the DisplayLink box powering my USB monitor.

As of Beta 7, OS 10.13.4 has restricted eGPU to Macs running Thunderbolt 3 (USB C) or later (which doesn't yet exist). Those who were running it off USB 3 or TB are not happy with Apple at the moment. Unfortunately, this has also killed all 3rd party display solutions for now including those apps that let you use an iPad as a remote monitor.

[bayswater]

As Apple has yet to write a white paper or guide to the practical applications of APFS, so much of this is a mystery. We know that, with an SSD, erased data is gone and that, between TRIM and garbage collection, there's no way to get it back through Trash Recovery, right? Uh huh... So, how come APFS Snapshots are able to completely restore an SSD instantly to a prior state as long as it isn't very old?

I guess is a set of tricks with the directories. I remember reading about APFS some time ago, that deleted files are not deleted, copied files are not saved, altered files are not altered, etc. The last one is something MS and some app developers have been doing for a long time -- just adding edits to a file and not actually editing the file.

[mikehalloran]

I guess is a set of tricks with the directories. ....

Something like that, I suppose.

I've a feeling that, when Apple tells us what's going on, we will all be blown away.

[mikehalloran]

I was playing with this last night and tested a few things. I was especially curious to see if APFS Snapshot recovery was confined to the boot drive or if it extended to attached drives.

As I pretty much expected, it works with the boot drive only. Other drives had to wait for Time Machine to query my backups. It may have been my imagination but the process felt faster than before but I have no proof.

The real question for me is if there is an advantage to having a larger boot drive. Oh yes. As far as I am concerned, external drives are for VIs, storage and Time Machine. I didn’t believe in having work files anywhere but the boot drive before and now I really don’t.

I had some problems with the recent 9.52 update which also affected a project I had worked on in 9.51. It was really nice to roll back my system a few hours to before I’d installed the update. I then reinstalled 9.52 and everything is working fine.

The culprit turned out to be corrupt headers in the audio I was given. It took a few minutes to strip and rebuild all of them in TwistedWave and I’m back in business. I can reproduce the problem but, since 9.52 is the symptom, not the culprit, I’m leaving it alone.

Still strange that 9.52 exposed the issue and 9.51 didn’t till after the 9.52 install. Being able to rewind my system and try again, I’m able to duplicate the conditions.

Not going into the actual problem except that it’s really weird and I hope not to encounter it again. No plugins or VIs were involved.

I could have used DSP-Q for the batch conversion when rebuilding the headers. QuickTime can do only one file at a time and using iTunes is way too convoluted.

[mikehalloran]

This thread is nearly five years old. OS 13 Ventura has introduced a change:

Once you have updated to OS 13 Ventura, You cannot revert to an earlier MacOS using APFS Snapshots.

Damn!

If you really, really, really need to revert, your choices are to

a) Make a USB Installer, wipe your System Drive, Install the MacOS of choice, Do a complete Time Machine Restore of your System Drive. (CCC and Super Duper! are APIs for Disk Utility/Time Machine no matter how many on MacRumors insist that's not true).

b) Use Internet Recovery to restore the MacOS that shipped with your Mac — this will wipe your System Drive. Do a complete Time Machine Restore of your System Drive. Update your MacOS to the one you want. This takes more time than (a).

c) Create a new APFS Volume on your System Drive and install your desired MacOS onto that (assuming that you have the drive space). You will need to reinstall some of your apps into the new Volume so that it can see the supporting files.

d) Install the desired MacOS onto an external SSD and boot from that. There are many issues involved with this including that most externals are slower. You will need to reinstall most of your apps into the new Volume so that it can see the supporting files.

I spent hours on the phone with Apple Engineering after Support tried to convince me that I could revert to Monterey without losing data. Engineering confirmed what I already knew.