How do I use time machine to access system files like /etc/hosts?

For OS X 10.11, El Capitan, the steps are:

  1. Open Applications > Time Machine; or use the Time Machine menu bar item and select Enter Time Machine.
  2. Reveal the Go to Folder sheet within Time Machine using the key combination: Command + Shift + G.
  3. Within the Go to Folder sheet enter the path /private/etc and select Go.
  4. You can now browse your back-ups of /etc/ and restore files as needed.

I just used Time Machine on Yosemite to recover /usr/bin/unzip; this is how I did it, given that my Time Machine backup disk is named Backup and my machine is named MyMacBook (not really):

  1. Set Finder to show all OS files: From a command line, run defaults write com.apple.finder AppleShowAllFiles YES

  2. Open a Finder window to your backup media (eg: Devices / Backup ) and then drill down into the latest appropriate backup. The Backups.backupdb/MyMacBook directory will have a series of directories named as timestamps (YYYY-MM-DD-HHMMSS) and Latest. Each of these directories represents a Time Machine backup.

    On my MacBook, the correct directory was Backups.backupdb/MyMacBook/2015-10-22-130134/Macintosh HD/usr/bin.

  3. Open another Finder window, then use CommandShiftG to go to your system folder (/usr/bin in my case).

  4. Drag and copy the file (unzip in my case) from the Time Machine window to the system window. You will probably be prompted for your password if it's a system file.

You can do this from the command line:

sudo cp -p /Volumes/Backup/Backups.backupdb/MyMacBook/2015-10-22-130134/Macintosh\ HD/usr/bin/unzip /usr/bin

I think that may be the only thing OS X recovers via Time Machine, especially in El Capitan, with its infamous System Integrity Protection (SIP).

If all you wish to be able to recover other than your user files is /etc/hosts, then set a root cronjob (or I guess I should say a launchd job) to scp or rsync the file somewhere else.

Note: crontab is supposedly "deprecated" in later versions of OS X in favor of launchd, but it still works (and IMHO, is way easier to setup than a scheduled task via launchd -- especially if you have a previous Linux/Unix background).

Otherwise, if you wish to recover the entire filesystem, you should look into alternative backup solutions such as CrashPlan, which is quite cheap, and pretty much the standard cloud backup solution these days.