I just clean installed macOS on a new VM and now need to set it up with various preferences and stuff to customize it. What I am curious about is where all those customizations actually get stored.

I think most are probably in Preferences plists but others might be in other system databases or third party app configuration files. Regardless, really I'm just wanting to see a list of files changed between "Point A" and some later "Point B" and this is probably interesting in a lot of other cases too.

Is there a way I can use the command line to:

  1. Trigger an APFS snapshot of my "Macintosh HD" boot disk — starting point "A"
  2. …then do whatever using the computer…
  3. Then trigger a new snapshot and/or at least compare now at time "B" what files have been modified since the snapshot at "A"?

Don't need a GUI or anything, just commands that would mark the snapshot and echo out a list of files that changed later. And I don't really need any sort of diff showing the changes within each files, just the overall paths/names of ones that did. (Also not really interested here in solutions based on file modification timestamps; I want to really know at the lower level even if some file's metadata didn't get touched for some reason.)

  • My understanding is that you need a special entitlement to create software that makes APFS snapshots. There used to be a tmutil snapshot command, but this has gone. tmutil startbackup will start a TM backup which will, as part of its function, create a snapshot - but that is probably not what you want.
    – Gilby
    Commented Feb 15, 2023 at 3:23
  • @Gilby Thanks! I guess to be clear the snapshot part doesn't have to be via CLI, but I looked in Disk Utility (as the most obvious GUI place that might be available) and there's no ability there either afaict. Bummer :-/
    – natevw
    Commented Feb 15, 2023 at 18:07
  • I would go with CCC, as suggested in @jksoegaard answer, to create a snapshot.
    – Gilby
    Commented Feb 15, 2023 at 22:28
  • 1
    @natevw You can actually enable APFS Snapshots in the View menu in Disk Utility, so you can view the snapshot list, mount them, open them in Finder, delete them, rename, copy, etc. However, you cannot actually create one :-|
    – jksoegaard
    Commented Feb 15, 2023 at 23:41

1 Answer 1


Unfortunately, using the command line to do APFS snapshots manually is quite a bit involved:

The program that issues the request to make the snapshot is required to have the com.apple.developer.vfs.snapshot entitlement, which is basically a sort of "permission slip" from Apple for that feature. Apple only gives that entitlement out to specific types of programs (i.e. backup software, disk cloning software, etc) - but as far as I know, no generic, command line tool has been given the entitlement.

A number of generic, command line tools do however exist - for example this:


However, you have to manually give it the above mentioned entitlement. It's easy enough, but macOS won't validate that entitlement per default. You have to disable some of the security feature in macOS in order to get such "homemade entitlements" to work. Specifically you need to disable SIP and boot up with amfi_get_out_of_my_way set. There's guides available to follow if you want to go down that route.

However, I propose a simpler solution:

Use one of the existing, already entitled, programs to create snapshots - and compare them using standard tools.

One idea would be to setup Time Machine backups (if you haven't done so already). Disconnect the backup disk so that snapshots are created locally. They're created once per hour - so it can be a bit of a waiting game. Note that snapshots are only kept around for 24 hours by default.

You can use Disk Utility to mount the snapshots afterwards, and then run the diff -r dirA dirB command in the Terminal to compare the two folders.

You could also just run full Time Machine backups to a connected disk - then you do not have to wait an hour in between snapshots. You can then use software such as BackupLoupe to see exactly what was changed between two backups.

Another option is using the software CarbonCopyCloner to create the snapshots. You'll need to enable APFS snapshots for the startup volume in the settings.

  • Like the CCC solution. Could create a very small backup which has snapshots enabled and run this manually whenever a new snapshot is wanted.
    – Gilby
    Commented Feb 15, 2023 at 22:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .