Recover Deleted Files Within 24 Hours With APFS Snapshots

Stop all disk writes immediately if you have lost data on your Mac. An APFS snapshot restore can bring back individual files or folders deleted within the last day through Time Machine, but it cannot revive a Mac that will not boot or a drive with a hardware fault. If your Mac still starts up normally, open Time Machine now and look for the file you need before that local snapshot ages out.

TL;DR:

• Local snapshots are retained for about 24 hours, making immediate action crucial after data loss occurs.
• Restoring individual files from a snapshot is quick and straightforward if the Mac boots normally, but full system recovery requires an external backup.
• Hardware issues like unmountable drives or physical damage prevent snapshot-based recovery, necessitating professional data recovery services.
• Apple restricts third-party reversion of snapshots due to security and filesystem constraints, leaving most users limited to file-level restores.
• Relying solely on local snapshots is risky, as they do not protect against disk failure or theft and are designed only as temporary safety nets.

Table of Contents

• What an APFS snapshot is and how Time Machine builds it
• When snapshots help and when they don’t: a quick decision guide
• How to restore individual files from a local snapshot
• How to restore a full system from an external Time Machine backup
• Viewing and managing snapshots through Disk Utility and the command line
• Why third-party snapshot reversion is restricted and where people go wrong
• When to call a pro: a practical triage checklist
• Same-day help when a snapshot can’t reach your files
• Where to verify these procedures directly from Apple
• Sources
• FAQ

What an APFS snapshot is and how Time Machine builds it

An APFS snapshot is a read-only, point-in-time capture of a volume’s exact state, essentially a frozen picture of your file system that lets macOS reference how things looked at a specific moment. Time Machine uses this feature to create local snapshots roughly every hour, storing them directly on your Mac’s internal drive rather than on an external backup disk.

These local snapshots are convenient because they let you recover a deleted file without plugging in a backup drive. But they come with real constraints:

• Local snapshots are typically retained for about 24 hours before macOS begins clearing them to free up space.
• Because they live on the same physical disk as your working data, they protect against accidental deletion but do nothing if that disk fails.
• macOS manages snapshot creation and deletion automatically. There is no user setting to extend retention indefinitely.

That last point matters more than most people realize. A snapshot is a safety net for a clumsy delete key, not a substitute for a real backup strategy that puts a copy of your data on a separate physical device.

When snapshots help and when they don’t: a quick decision guide

Local snapshots solve a narrow set of problems well. They are the right tool when you accidentally deleted a file this morning, overwrote a document with an unwanted edit, or want to pull an earlier draft of something you are still actively working on, all within that roughly 24 hour window.

They are the wrong tool once the problem moves from “I made a mistake” to “my Mac has a mechanical or electrical problem.” If your Mac will not boot, if the internal drive will not mount, if you have liquid damage, or if an encrypted NVMe drive refuses to show up in Disk Utility, no amount of snapshot browsing will fix that. Those are hardware or firmware issues, and pulling up Time Machine will not even be possible.

Time Machine local snapshots are created roughly every hour and kept for about 24 hours before macOS clears them to reclaim space, according to Apple’s own documentation. That short window is the practical reason to act the moment you notice something missing.

Right now, if you suspect data loss:

• Stop using the affected Mac and avoid saving new files to the same volume.
• Check whether you have an external Time Machine backup connected or recently updated.
• Write down what you were doing right before the files went missing, since that detail helps with troubleshooting either path below.

How to restore individual files from a local snapshot

If your Mac is running normally and you just need a file back, this is a task you can usually finish in a few minutes. The process works because Time Machine’s interface can browse local snapshots directly, even without an external backup drive connected.

Before you start:

1. Close any applications that are actively writing to the affected disk, including cloud sync clients such as iCloud Drive, Dropbox, or Google Drive, which can overwrite files while you are trying to recover them.
2. Avoid creating new files or installing anything until the restore is complete, since new writes can eventually push out the snapshot you need.

To restore the file or folder:

1. Open a Finder window and navigate to the folder that used to contain the missing item.
2. Launch Time Machine from the menu bar clock icon or from the Applications folder.
3. Use the timeline on the right edge of the screen, or the up and down arrows, to move through the available local snapshots.
4. When you spot the version of the folder that has your file, select it and click Restore.
5. Confirm the restored file lands in its original location, then open it to verify it is intact.

If the Time Machine icon is not visible in your menu bar, go to System Settings > General > Time Machine, or search for Time Machine directly in System Settings, to open the interface manually. Apple’s guide to restoring files with Time Machine walks through the same browsing steps in more detail if your setup looks different from the standard menu bar flow.

Pro Tip: The moment your file is back, copy it to an external drive or cloud folder. A local snapshot is temporary, and treating a successful restore as your new backup defeats the purpose of the exercise.

How to restore a full system from an external Time Machine backup

Local snapshots cannot rebuild an entire system, especially when the internal drive has failed, when you are moving to a new Mac, or when the operating system itself will not start. For that scenario, you need an actual external Time Machine backup and one of two supported paths.

1. Boot into macOS Recovery. On Apple silicon Macs, press and hold the power button until “Loading startup options” appears, then choose Options. On Intel Macs, restart and hold Command-R. Apple’s recovery startup guide covers both paths in detail.
2. Choose your restore method. From the macOS Recovery utilities window, select Restore From Time Machine Backup if you want to reinstall your entire system and data at once, or choose Reinstall macOS first and use Migration Assistant afterward if you only want to bring back specific accounts and files.
3. Select your backup disk and a restore point. Connect your external Time Machine drive, choose it from the list, then pick the date and time you want to restore from.
4. Follow the onscreen prompts. macOS will restore your applications, user accounts, settings, and files from that backup, which can take anywhere from a few minutes to several hours depending on how much data is involved.
5. Verify once the Mac restarts. Check that your files, applications, and login accounts all look correct, and expect Time Machine to kick off a fresh full backup shortly after, since the restore effectively resets its baseline.

If you prefer to keep your current macOS installation and just bring over specific data, Migration Assistant can pull user accounts, apps, and files from a Time Machine backup without a full system restore. Either path depends entirely on having that external backup available. Without one, a failed internal drive leaves nothing for macOS Recovery to work with.

Viewing and managing snapshots through Disk Utility and the command line

For a closer look at what snapshots actually exist on your Mac, Disk Utility offers a built-in viewer. Open Disk Utility, select your volume, and choose View > Show APFS Snapshots to see a list of every snapshot currently stored, along with details you can inspect further.

• Each row in the snapshot table represents one point-in-time capture, tied to a timestamp.
• You can copy metadata such as the UUID and XID directly from that table if you need to reference a specific snapshot in Terminal.
• The size shown for a snapshot reflects filesystem metadata and changed blocks, not the full size of your recoverable data, so do not use it to estimate how much you can restore.

Terminal offers a more direct route for advanced users. Running sudo tmutil listlocalsnapshots / lists every local snapshot on the root volume, while sudo tmutil deletelocalsnapshots YYYY-MM-DD-HHMMSS removes a specific one by its timestamp.

Snapshot management through the command line is meant for cleanup and inspection, not for forcing a full system revert.

Do not attempt unsupported revert operations through Terminal or third-party scripts. These commands are built for viewing and clearing snapshots, not for rolling an entire volume backward, and pushing them beyond that intended use risks corrupting the very data you are trying to protect.

Why third-party snapshot reversion is restricted and where people go wrong

Apple locks down the ability to programmatically revert a volume to a snapshot, and that restriction is deliberate rather than an oversight. Reverting a snapshot at the filesystem level requires specific entitlements, including com.apple.developer.vfs.snapshot and com.apple.private.apfs.revert-to-snapshot, and Apple’s developer forums confirm that these are reserved largely for internal or whitelisted system tools rather than general third-party apps.

That restriction is frustrating if you were hoping a downloaded utility could roll your whole drive back to a snapshot with one click. In practice, no mainstream consumer tool has that ability, and the few paths that do exist depend on entitlements Apple does not hand out freely.

A few pitfalls worth avoiding:

• Disabling System Integrity Protection or AMFI to force a low-level snapshot reversion is a technique sometimes discussed in forensic or lab contexts, but it carries real risk of data loss for a home user and is not something to attempt on a Mac holding data you care about.
• Local snapshots age out automatically on a fixed schedule and were never designed as a long-term backup, so relying on them as your only safety net leaves you exposed the moment that window closes.
• An encrypted internal SSD, particularly one tied to a T2 chip or Apple silicon Secure Enclave, resists simple block-level copying to another drive, which is part of why Apple’s own engineering sessions describe device-native, hardware-aware recovery approaches rather than generic disk cloning.

When to call a pro: a practical triage checklist

Certain symptoms mean a snapshot restore was never going to work, and pushing forward on your own risks making the underlying problem worse. If your drive will not mount, if the Mac shows physical damage from a drop or spill, if you hear clicking from an older mechanical drive, or if an encrypted NVMe volume refuses to appear even in Disk Utility, that is a hardware or firmware issue that needs lab-level intervention.

Professionals in that situation start with forensic imaging to capture whatever data is still accessible before it degrades further, then move to component-level diagnostics and, where needed, micro-soldering on the logic board itself. This is also where forensic imaging before repair becomes critical, since any further writes to a failing drive can overwrite exactly the sectors holding your files.

MacWest Data Recovery provides Mac data recovery and repair services, offering diagnostics and a no recovery, no charge policy on jobs.

— Kaya

Same-day help when a snapshot can’t reach your files

When the problem is a file you deleted an hour ago, Time Machine and a local snapshot are usually all you need. When the problem is a Mac that will not mount its drive, a cracked logic board, or an encrypted volume that has gone dark, that is a different job, and it is the one MacWest Data Recovery handles every day for clients across West LA, Santa Monica, and Beverly Hills, along with Brentwood, Westwood, Venice, Hollywood, and Culver City.

They offer diagnostics and a no recovery, no charge policy, with forensic imaging and logic board repair for cases beyond typical repair options. Same-day appointments are available for urgent situations, and our lab sits centrally at 12041 Wilshire Blvd, Ste 26, between the 405 and Santa Monica, close to UCLA and the Getty Center.

Before you call, have your Mac model on hand, a note of what you were doing right before the problem started, whether an external Time Machine backup exists, and a description of the symptoms you’re seeing. Then call 310-866-0828 or visit our data recovery services page to get started, or check the Mac repair service page if the issue looks hardware related.

Where to verify these procedures directly from Apple

The steps and limits described above come straight from Apple’s own documentation, which is worth bookmarking if you want to double check a step mid-recovery.

• Apple’s overview of local Time Machine snapshots explains creation frequency and retention.
• Apple’s guide to restoring files with Time Machine covers the file-level restore flow in the interface.
• Apple’s macOS Recovery startup guide details the full-system restore path.
• The Apple Developer Forums thread on snapshot entitlements explains why third-party reversion tools are limited.

Sources

• About Time Machine local snapshots – Apple Support
• Restore items backed up with Time Machine on Mac – Apple Support
• How to start up from macOS Recovery – Apple Support

FAQ

How do I restore a snapshot on my Mac?

Open Time Machine from the menu bar or Applications folder, navigate to the folder that held your missing file, and use the timeline to browse local snapshots. Select the file or folder you need and click Restore, and it will return to its original location as described in Apple’s restore guide.

What is an APFS snapshot?

An APFS snapshot is a read-only, point-in-time capture of a volume’s exact state at the moment it was taken. Time Machine uses this feature to create local snapshots roughly every hour, keeping them on your internal drive so you can recover recent files without an external backup.

How do I revert my Mac back to a snapshot?

For individual files, use the Time Machine interface to browse and restore specific items from a local snapshot rather than reverting the entire volume. For a complete system revert, especially after a hardware failure, boot into macOS Recovery and restore from an external Time Machine backup instead, since full-volume snapshot reversion is not exposed to everyday users.

How long do local Time Machine snapshots last?

Local snapshots are generally kept for about 24 hours before macOS automatically clears them to free up disk space, according to Apple’s documentation. That short window is why acting quickly after noticing a missing file matters.

Can I use APFS snapshots instead of a real backup?

No. Local snapshots live on the same physical disk as your data, so they protect against accidental deletion but not against drive failure, theft, or physical damage. An external Time Machine backup or another off-disk copy remains necessary for real data protection, a point Apple itself makes clear in describing how local snapshots fit into its broader backup system.

Recommended

• APFS Data Recovery: A Practical Playbook for Mac Users
• Disk Utility Erase Recovery: What to Do After a Mac Reformat
• Top Mac data recovery challenges and solutions for LA users
• How to Recover Files After You Emptied the Trash