Running time machine and High Sierra, my MacBook Air got invaded.

So I want to restore it to the backup on Time Machine from earlier this morning.

But it’s not clear how I can specify from when I want to restore the machine.

I’ve tried using the Migration Assistant.

So, how do I recover the entire system from a specific point from my Time Machine backup?

  • Have a look at: Restore your Mac from a backup That said, I do a clean install of the OS and then restore your files from the backup. Commented Aug 7, 2020 at 19:10
  • @user3439894 that would be better as an answer...
    – Solar Mike
    Commented Aug 7, 2020 at 19:46
  • @user3439894 no where on those pages does it say how to select a specific point in the past to restore from, it simply identifies the latest backup on the drive, which is not what I want to use. Commented Aug 7, 2020 at 19:48
  • 2
    "Invaded"? What do you mean? Malware?
    – benwiggy
    Commented Aug 7, 2020 at 20:00

2 Answers 2


i guess you are looking for something like this: https://maclovin.org/blog-native/2017/restoring-from-a-snapshot-with-apfs. It can alternatively be done from command line as tmutil restore. See man tmutil for more information.

  • Good point. If the OP is running Time Machine, they may be able to restore to a snapshot point.
    – TJ Luoma
    Commented Aug 7, 2020 at 23:04

In order to restore from “a point in time,” you have to have a backup from that point in time.

  • APFS (since High Sierra) allows you to create snapshots of the startup volume
  • Time Machine is a time-tested backup and restore utility that allows you to recover from data loss

There is an inherent requirement, however, to use either of these tools to fix whatever has caused your data loss/corruption: you have to take the snapshot or create the backup in order to restore from them.

Since you stated you have a Time Machine Backup from “this morning,” you just need to restore it. Apple Support has excellent step-by-step instructions on how to restore from a a TM backup (includes instructions on how to restore from a local snapshot as well).

You can quickly create a snapshot before you attempt something like installing questionable software or performing an update. I do this all the time (never had to restore, thankfully). Simply issue the command

% tmutil snapshot

You will get a confirmation message that your snapshot was created. To list the snapshots taken, just issue the command

% tmutil listsnspshots /

Finally, you can use Time Machine to restore from one of thise snapshots even if you didn't use Time Machine to create regular backups.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .