How can I restore a single file from an old Time Machine backup using only the Command Line Interface?

I took a snapshot of my MacOS system using Time Machine some time ago, and I'd like to restore just one file from it.

Also, I don't have GUI access to this box; only ssh (with root privilege).

Is it possible to restore just one file from a Time Machine backup using the CLI over SSH? If so, how?


3 Answers 3


You can browse to the files directly and restore them with the rsync command.

Determine path to Backups

First, list all of your existing backups using tmutil listbackups

user@host ~ % tmutil listbackups
user@host ~ %

Enter Backup Directory

Next, cd into one of the above directories (the one from which you want to restore)

user@host ~ % cd /Volumes/externalBackups/Backups.backupdb/host/2020-06-21-110109
user@host 2020-06-21-110109 % 

Enter Backup's Data Directory

There should be a - Data directory with the data from this particular Time Machine backup. In this case, our backups were created with tmutil startbackup, so the Data Directory is Untitled - Data

user@host 2020-06-21-110109 % ls | grep -i Data
Untitled - Data
user@host 2020-06-21-110109 % 

user@host 2020-06-21-110109 % cd "Untitled - Data"
user@host Untitled - Data % 

Restore with rsync

You can restore a given file with rsync. For example, to restore the /private/etc/resolv.conf file to your system, you can now execute the following

user@host Untitled - Data % sudo rsync -av --progress private/etc/resolv.conf /private/etc/resolv.conf
user@host Untitled - Data % 
  • 3
    Personally I prefer using rsync rather than cp. However, since the intention is to use the cp command to restore a file from a "backup", I would recommend using cp -p. This way the restored file preserve the following attributes of each source file in the copy: modification time, access time, file flags, file mode, user ID, and group ID, as allowed by permissions.
    – wch1zpink
    Commented Jun 14, 2022 at 20:44
  • 1
    Yes to the above, and ideally rsync -a for the same reason @wch1zpink mentioned.
    – Scot
    Commented Jun 14, 2022 at 22:03
  • changed to rsync. I also prefer it, but I wasn't sure if it was installed by default in MacOS. Commented Jun 15, 2022 at 9:19
  • 1
    rsync is installed by default in macOS BUT it is an old version and does not support all ACL. You really should install a newer version (rsync changed to GPLv3 and Apple provide the last GPL 2 version)
    – mmmmmm
    Commented Jun 16, 2022 at 10:19
  • 1
    I wonder if it would be safer to use ditto because it copies meta-data ("resource forks, extended attributes, Access Control Lists (ACLs), as well as quarantine bits")—or, these things only apply to HFS and not APFS
    – huyz
    Commented Oct 3, 2022 at 4:09

Use tmutil restore

As a long time Unix fan I do love rsync. Using the native rsync for this purpose, even in macOS Ventura 13.2, does have some downsides though:

  1. As suggested in a comment by huyz, rsync isn't macOS aware. I have found that it won't copy any of the extended attributes of files that you use it to restore.
  2. rsync isn't a Time Machine utility program that's Time Machine aware, and seems unlikely to receive specific support from Apple for the purpose of restoring files from Time Machine.

Alternatively, use tmutil.

tmutil is the Apple provided Time Machine command line utility supporting the restore action (since at least macOS 10.15):

tmutil restore src ... dst

The manual page for tmutil for the restore action says:

restore [-v] src ... dst

Restore the item src, which is inside a backup, to the location dst. The dst argument mimics the destination path semantics of the cp tool. You may provide multiple source paths to restore. The last path argument must be a destination.

When using the restore verb, tmutil behaves largely like Finder. Custom Time Machine metadata (extended security and other) will be removed from the restored data, and other metadata will be preserved.

Root and Full Disk Access privileges may be required to perform restores. When restoring with tmutil as root, ownership of the restored items will match the state of the items in the backup.

Here's an example of what this looks like. This is for a restore of the contents of my other Mac's (Other System) Downloads folder. And my shell is in the folder of that backup I wanted to restore from:

Downloads $ tmutil restore * ~/Downloads 
Total copied: 2273.96 MB (2384424593 bytes)
Items copied: 76143
Downloads $ pwd
/Volumes/My Disk 1/Backups.backupdb/Other System/Latest/Macintosh HD - Data/Users/louis/Downloads
Downloads $ ls -l@ manual.docx            
-rw-r--r--@ 99 louis  staff  381577 Dec  5  2015 manual.docx
    com.apple.finder.copy.source.checksum#N      4 
    com.apple.metadata:_kTimeMachineNewestSnapshot      50 
    com.apple.metadata:_kTimeMachineOldestSnapshot      50 
    com.apple.metadata:kMDItemDownloadedDate        53 
    com.apple.metadata:kMDItemWhereFroms       218 
    com.apple.quarantine        57 
Downloads $ ls -l@ ~/Downloads/manual.docx            
-rw-r--r--@ 1 louis  staff  381577 Dec  5  2015 /Users/louis/Downloads/manual.docx
    com.apple.metadata:kMDItemDownloadedDate        53 
    com.apple.metadata:kMDItemWhereFroms       218 
    com.apple.quarantine        57 
Downloads $ tmutil compare manual.docx ~/Downloads/manual.docx 

Added:         0B
Removed:       0B
Changed:       0B
Downloads $

The command line src ... and dst arguments in this regard are just like what I'd use for rsync or cp. The difference being that using tmutil restore, all of the metadata for the files appear to be preserved with the exception of "Time Machine metadata" - which I take to be metadata that appears associated with the backup folder files but not with the original nor restored files. Thus the restored files and their metadata look to me to be exactly what they had been on the original computer from where they'd been backed up from.

  • 1
    Can you please provide an example execution in your answer? Commented Feb 2, 2023 at 15:06
  • @MichaelAltfield I liked your suggestion and have edited my answer with additional details like an example execution. Commented Feb 2, 2023 at 18:35

If you find a GUI easier to navigate, you should be able to use an FTP client (Transmit, Filezilla, Cyberduck, etc.) and connect to your Time Machine backup via sftp.

  • Because original poster stated they didn’t have GUI access but did have SSH, which means an SFTP client would provide GUI access. Not necessarily going to be obvious to all users this is an option. I’ve used the same approach with my own TimeMachine backup, to access specific files remotely from my home server via SFTP. Poster asked how to pull one file over SSH. This is a viable option.
    – dr.nixon
    Commented Feb 3, 2023 at 3:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .