APFS Snapshots Saved The Day

1 minute read

I had a shocker earlier with an out of control1 shell script that was supposed to tidy up a load of empty directories on my Mac. Just in my home dir I had nearly 18,000 empty directories:

james@Jamess-iMac: ~
$ find . -not \( -name .svn -prune -o -name .git -prune \) -type d -empty | wc -l
   17825

I wrote a test script to try out on a few directories. The next thing I saw … rm -rf / commands whizzing past on my terminal. Then things stopped working: bash had been deleted.

I use Homebrew so /usr/local is writable by my user. And deletable. So my /usr/local/bin dir was gone, along with some other files.

I’m a proper backup nerd and have multiple backup strategies:

The clone was a few weeks old, my /usr/local changes all the time. It wasn’t usable.

TIP

Clone your drive often and test that it works!

However, I’d been learning about APFS, and had taken a snapshot .. yesterday.

APFS is Apple’s new filesystem:

Apple File System is a new, modern file system for iOS, macOS, tvOS, and watchOS. It is optimized for Flash/SSD storage and features strong encryption, copy-on-write metadata, space sharing, cloning for files and directories, snapshots, fast directory sizing, atomic safe-save primitives, and improved file system fundamentals.

What’s a snapshot?

A volume snapshot is a point-in-time, read-only instance of the file system.

Time Machine also takes local snapshots if your backup drive isn’t available, so I actually had a few snapshots:

$ tmutil listlocalsnapshots /
com.apple.TimeMachine.2018-04-30-165525
com.apple.TimeMachine.2018-04-30-175518
com.apple.TimeMachine.2018-04-30-185503
com.apple.TimeMachine.2018-04-30-195506
com.apple.TimeMachine.2018-04-30-205509
com.apple.TimeMachine.2018-04-30-215522
com.apple.TimeMachine.2018-04-30-225512
com.apple.TimeMachine.2018-04-30-235517
com.apple.TimeMachine.2018-05-01-005520
com.apple.TimeMachine.2018-05-01-015548
com.apple.TimeMachine.2018-05-01-025524

You can use tmutil to compare and restore, or simply Time Machine, but the files are available right there on the filesystem, I just had to copy my missing files back into the right places from the local snapshot dir:

$ cd /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/James’s\ iMac/2018-05-01-025524/Macintosh\ HD/usr/local/

james@Jamess-iMac: /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/James’s iMac/2018-05-01-025524/Macintosh HD/usr/local
$ ls
Caskroom      Frameworks    MacGPG2       etc           lib           opt           remotedesktop share
Cellar        Homebrew      bin           include       man           pear          sbin          var

Phew. All fixed.

Do I like APFS?


  1. Er, poorly written.