Time Machine makes it easy to recover older versions of your personal users files; How do you restore an older version of a system file (such as /etc/hosts) using Time Machine?


3 Answers 3


For OS X 10.11, El Capitan, the steps are:

  1. Open Applications > Time Machine; or use the Time Machine menu bar item and select Enter Time Machine.
  2. Reveal the Go to Folder sheet within Time Machine using the key combination: Command + Shift + G.
  3. Within the Go to Folder sheet enter the path /private/etc and select Go.
  4. You can now browse your back-ups of /etc/ and restore files as needed.

I just used Time Machine on Yosemite to recover /usr/bin/unzip; this is how I did it, given that my Time Machine backup disk is named Backup and my machine is named MyMacBook (not really):

  1. Set Finder to show all OS files: From a command line, run defaults write com.apple.finder AppleShowAllFiles YES

  2. Open a Finder window to your backup media (eg: Devices / Backup ) and then drill down into the latest appropriate backup. The Backups.backupdb/MyMacBook directory will have a series of directories named as timestamps (YYYY-MM-DD-HHMMSS) and Latest. Each of these directories represents a Time Machine backup.

    On my MacBook, the correct directory was Backups.backupdb/MyMacBook/2015-10-22-130134/Macintosh HD/usr/bin.

  3. Open another Finder window, then use CommandShiftG to go to your system folder (/usr/bin in my case).

  4. Drag and copy the file (unzip in my case) from the Time Machine window to the system window. You will probably be prompted for your password if it's a system file.

You can do this from the command line:

sudo cp -p /Volumes/Backup/Backups.backupdb/MyMacBook/2015-10-22-130134/Macintosh\ HD/usr/bin/unzip /usr/bin

I think that may be the only thing OS X recovers via Time Machine, especially in El Capitan, with its infamous System Integrity Protection (SIP).

If all you wish to be able to recover other than your user files is /etc/hosts, then set a root cronjob (or I guess I should say a launchd job) to scp or rsync the file somewhere else.

Note: crontab is supposedly "deprecated" in later versions of OS X in favor of launchd, but it still works (and IMHO, is way easier to setup than a scheduled task via launchd -- especially if you have a previous Linux/Unix background).

Otherwise, if you wish to recover the entire filesystem, you should look into alternative backup solutions such as CrashPlan, which is quite cheap, and pretty much the standard cloud backup solution these days.

  • 1
    Time Machine does back up the entire system, at least up through Yosemite. Dec 3, 2015 at 0:56
  • That's what I'm saying though -- I'm not sure El Capitan supports full system backups because of the new System Integrity Protection, which is pretty much supposed to prevent anything from being changed outside of /Users. This is something I/you/we/OP should do some further research on, because SIP was really a game-changer for a lot of things in OS X and changed the functionality of a lot of things. I imagine whether it is turned on or off could possibly make a big difference for Time Machine backups in El Capitan. I guess it would help to know what version of OS X OP is running. Dec 5, 2015 at 14:27
  • I won't find out until my company moves beyond Yosemite; ask me again in 6 months. Dec 7, 2015 at 6:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .