How does APFS manage snapshots?

What are snapshots

The snapshot feature is used to ensure the reliability of your data and to make it possible to roll back the file system to an earlier point in time. In other words, if you ever need to return your Mac to a previous state, you can simply restore to that relevant snapshot.

How do snapshots work?

APFS keeps track of snapshots by keeping a single volume checkpoint for each snapshot that’s been created. This is done by ensuring that the contents of any files that are part of a snapshot are protected from deletion. APFS achieves this 'protection' by:

1. ensuring that if/when these files are deleted after a particular snapshot was created, the blocks containing the data from those files are not actually overwritten, even though the meta-data associated with those files is erased from the file system hierarchy
2. continuing to protect this data for as long as that particular snapshot exists

How are snapshots created?

Assuming you have macOS High Sierra (or above) installed and that your boot volume is formatted as APFS, your Mac will automatically create a snapshot before installing any operating system updates.

You can also create snapshots manually as follows:

1. Open the Terminal app (by default it’s located in the Utilities folder within your Applications folder)

2. Now copy and paste the following command into Terminal:

   tmutil snapshot

3. Press Enter

4. A confirmation message will appear within Terminal

NOTE: At present snapshots older than 24 hours are automatically deleted. As a result, manually creating a snapshot as per the steps above is an excellent strategy when you're about to install any major new software/hardware or if you're about to undertake some testing. Having a snapshot gives you a "get out of jail free" card, albeit only valid for 24hrs!

For more info on how you can restore from a snapshot, refer to the following:

• About Time Machine local snapshots

• Restoring from a snapshot with APFS