What is in the APFS Startup Snapshot (not a Time Machine local snapshot)? Does it contain a snapshot of the totality of my Mac? Like would it save things like browser caches, memory, swapfiles, or sleep images? I'm trying to recover a file with some financial information, and I'm wondering if I might be able to recover it from there.
MacBook Pro 13″, macOS 14.1
To recovery " financial information " you would need to have been using some type of Backup Software
If you have used or are using Time Machine Backup Utility you maybe able to Restore the Deleted Files
For future purposes
To truly protect your non replaceable Data
Have a 3-2-1 Rescue Plan in place and always current
3 Backups using 2 methods and 1 off site incase of natural disaster or un-natural disaster.
Each of the above should be done to a Dedicated Single Purposed External Drive
Below link is intended to augment what TM Backup does
As for the " APFS Startup Snapshot " and " I'm wondering if I might be able to recover it from there."
NO
This is technically the macOS operating system which resides in a sealed and read-only volume that can’t be opened by users or third-party applications.
You neither add nor remove anything from this Volume
To recovery " financial information " you would need to have been using some type of Backup Software
If you have used or are using Time Machine Backup Utility you maybe able to Restore the Deleted Files
For future purposes
To truly protect your non replaceable Data
Have a 3-2-1 Rescue Plan in place and always current
3 Backups using 2 methods and 1 off site incase of natural disaster or un-natural disaster.
Each of the above should be done to a Dedicated Single Purposed External Drive
Below link is intended to augment what TM Backup does
As for the " APFS Startup Snapshot " and " I'm wondering if I might be able to recover it from there."
NO
This is technically the macOS operating system which resides in a sealed and read-only volume that can’t be opened by users or third-party applications.
You neither add nor remove anything from this Volume
The Startup Snapshot is your operating system. Do not touch it. The other two snapshots are related to macOS updates, also do not touch them. None of them contain any user data whatsoever.
SMacTalk wrote:
I see. To clarify, the Startup Snapshot will be a snapshot of the operating system, and won't have any other files or data?
It is a snapshot of the parts of the operating system that are in the "signed sealed system volume" – including most, but not all, of the applications bundled with the Mac.
In recent versions of macOS, what the Finder shows as a single volume, e.g., "Macintosh HD" is, underneath, a combination of a cryptographically-signed sealed system volume, and a "Data" volume where your data – and macOS files that the operating system might need to modify in normal operation – reside.
At startup time, the Mac checks the cryptographic seal on the signed sealed volume. If the test fails, the Mac assumes that the volume has been corrupted or tampered with by malware, and refuses to start up from that volume. If the test succeeds, the Mac creates a read-only APFS snapshot of the signed sealed volume, then actually runs off of the snapshot. It does this to provide a further barrier to malware attack.
If you looking for a List all local Time Machine snapshots
Use the Terminal application and use the below command
tmutil listlocalsnapshots /
You’ll see output like:
com.apple.TimeMachine.2024-01-20-123456
I see. To clarify, the Startup Snapshot will be a snapshot of the operating system, and won't have any other files or data?
A somewhat related question is that, using the Terminal, I found there were 3 snapshots for "disk3s1s1". Two of them were "com.apple.os.update-" followed by a string of numbers, and the third was "com.apple.os.update-MSUPrepareUpdate." What is contained in these snapshots? Are these snapshots of the OS only as well, or would there potentially otherwise ephemeral data in there (like the aforementioned browser caches, memory, swapfiles, or sleep images)?
1 - Give us a Screen Shot from the Terminal command
diskutil apfs list
2 - We understand your concerns regarding " 3 snapshots "
3 - Though, what is the Top Priority at this time
4 - The Snapshot or " I'm trying to recover a file with some financial information " ??
As long as we maybe digressing
User byline showing " MacBook Pro 13″, macOS 14.1 Released October 25, 2023
The current version has long passed this and landing on Sonoma 14.8.3 , Released Dec 12, 2026
In conscience >> Always make a Time Machine Backup before doing any upDates
Better still
To truly protect your non replaceable Data
Have a 3-2-1 Rescue Plan in place and always current
3 Backups using 2 methods and 1 off site incase of natural disaster or un-natural disaster.
Each of the above should be done to a Dedicated Single Purposed External Drive
Below link is intended to augment what TM Backup does
This is the screenshot.
It's not super critical the information I'm trying to retrieve. I'm trying to get an old W2, and I can get that from work when the next work week starts; I was just being impatient and trying to see if I could get it sooner by recovering data. But I am genuinely interested in this AFPS snapshot stuff, and trying to figure it out and research on my own wasn't helping.
The byline is actually incorrect, I have a MacBook 14" and am currently running Sonoma 14.5.
@ MartinR
Definitely won't touch them. I never touch anything until I'm absolutely sure what they are, and what the consequences of messing with them will be.
If I may ask, since all three of the 3 snapshots for "disk3s1s1" mention updates, which of the two "com.apple.os.update-" followed by a string of number snapshots or "com.apple.os.update-MSUPrepareUpdate" snapshot is the OS snapshot, and which are the update snapshots?
@ MartinR
All three snapshots have "update" in it. The Startup Snapshot appears to be one of the "com.apple.os.update-" with a long alphanumeric string, which means that the other "com.apple.os.update-" with an alphanumeric string and the "com.apple.os.update-MSUPrepareUpdate" snapshot are not startup snapshots but still related to updates?
And none of these three have user data?
SMacTalk wrote:
@ MartinR
All three snapshots have "update" in it. The Startup Snapshot appears to be one of the "com.apple.os.update-" with a long alphanumeric string, which means that the other "com.apple.os.update-" with an alphanumeric string and the "com.apple.os.update-MSUPrepareUpdate" snapshot are not startup snapshots but still related to updates?
And none of these three have user data?
No- full stop
For additional reading on the Drive Structure for Apple Silicon computer
Although is mentions macOS 2 Monterey the drive structure has not really changed on macOS 14 Sonoma on Apple M-Class computers
Still badly outdated
If the name includes "update" it is associated with updates.
Pretty much ALL USER DATA would be in and nowhere else
OK, so there won't be any user data in the two "com.apple.os.update-" with alphanumeric string and the "com.apple.os.update-MSUPrepareUpdate" snapshots, correct?
AFPS Startup Snapshot Contents