APFS Snapshots Saved The Day
I had a shocker earlier with an out of control1 shell script that was supposed to tidy up a load of empty directories on my Mac. Just in my home dir I had nearly 18,000 empty directories:
james@Jamess-iMac: ~
$ find . -not \( -name .svn -prune -o -name .git -prune \) -type d -empty | wc -l
17825
I wrote a test script to try out on a few directories. The next thing I saw … rm -rf / commands whizzing past on my terminal. Then things stopped working: bash had been deleted.
I use Homebrew so /usr/local is writable by my user. And deletable. So my /usr/local/bin dir was gone, along with some other files.
I’m a proper backup nerd and have multiple backup strategies:
- Time Machine to my NAS.
- ChronoSync to a Docker container running CrashPlan.
- Backblaze.2
- Finally, and this is what let me down, a Carbon Copy clone of my main drive.
The clone was a few weeks old, my /usr/local changes all the time. It wasn’t usable.
TIP
Clone your drive often and test that it works!
However, I’d been learning about APFS, and had taken a snapshot .. yesterday.
APFS is Apple’s new filesystem:
Apple File System is a new, modern file system for iOS, macOS, tvOS, and watchOS. It is optimized for Flash/SSD storage and features strong encryption, copy-on-write metadata, space sharing, cloning for files and directories, snapshots, fast directory sizing, atomic safe-save primitives, and improved file system fundamentals.
What’s a snapshot?
A volume snapshot is a point-in-time, read-only instance of the file system.
Time Machine also takes local snapshots if your backup drive isn’t available, so I actually had a few snapshots:
$ tmutil listlocalsnapshots /
com.apple.TimeMachine.2018-04-30-165525
com.apple.TimeMachine.2018-04-30-175518
com.apple.TimeMachine.2018-04-30-185503
com.apple.TimeMachine.2018-04-30-195506
com.apple.TimeMachine.2018-04-30-205509
com.apple.TimeMachine.2018-04-30-215522
com.apple.TimeMachine.2018-04-30-225512
com.apple.TimeMachine.2018-04-30-235517
com.apple.TimeMachine.2018-05-01-005520
com.apple.TimeMachine.2018-05-01-015548
com.apple.TimeMachine.2018-05-01-025524
You can use tmutil to compare and restore, or simply Time Machine, but the files are available right there on the filesystem, I just had to copy my missing files back into the right places from the local snapshot dir:
$ cd /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/James’s\ iMac/2018-05-01-025524/Macintosh\ HD/usr/local/
james@Jamess-iMac: /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/James’s iMac/2018-05-01-025524/Macintosh HD/usr/local
$ ls
Caskroom Frameworks MacGPG2 etc lib opt remotedesktop share
Cellar Homebrew bin include man pear sbin var
Phew. All fixed.
Do I like APFS?