How can I mount a TimeMachine Backup snapshot in the Terminal via mount_apfs?

Question

I backup my Apple Silicon Mac (running macOS Sonoma) to an external, directly attached drive via Time Machine.

All backup snapshots on that external drive I can list via

$ ls -1 /Volumes/.timemachine/<GUID>/

(<GUID> is here a long hexadecimal number identifier.) In this directory are all the snapshots, for example

/Volumes/.timemachine/<GUID>/2024-03-14-123547.backup

However inside the snapshot folder is no accessible Data directory. So I think I need to mount the snapshot before I can access its data in the Terminal.

So I tried

$ mkdir ~/TM_Backup
$ mount_apfs  -s com.apple.TimeMachine.2024-03-14-123547 / ~/TM_Backup

But I always get the error message "mount_apfs: volume could not be mounted: Resource busy" (I get this error with _all snapshots, so there must be something wrong with the command.)

How can I mount the TimeMachine Backup snapshot via a Terminal command?

Answer 1

Part 1 - the role of /Volumes/.timemachine

There is a misconception about what is in /Volumes/.timemachine/<GUID>/. It contains mount points which may or may not have mounted TM snapshots. Some of these mount points relate to TM snapshots which still exists, but most refer to snapshots which have been thinned and so no longer exist.

If I choose a mount point for a snapshot which no longer exists then, like you, I get nothing:

ls -l /Volumes/.timemachine/84A3891E-14F5-4FEE-A1A0-F3F501863D11/2024-04-12-015857.backup
total 0

But I can use Finder to see which snapshots still exist in my TM backup. Choose one of them and ls gives:

ls -l /Volumes/.timemachine/84A3891E-14F5-4FEE-A1A0-F3F501863D11/2024-04-11-124649.backup
total 64
drwxr-xr-x@ 5 root  wheel    160 11 Apr 12:44 2024-04-11-124649.backup
-rw-r--r--@ 1 root  wheel  32077 11 Apr 11:46 backup_manifest.plist

(I have deliberately used ls -l and not ls -1 as you did)

Go one level deeper to see the - Data folder:

ls -l /Volumes/.timemachine/84A3891E-14F5-4FEE-A1A0-F3F501863D11/2024-04-11-124649.backup/2024-04-11-124649.backup
total 0
drwxrwxr-x@ 22 root  admin  704 11 Apr 12:46 BethSSD - Data

I am somewhat surprised that macOS does not remove the mount points referring to thinned (no longer existing) snapshots.

Part 2 - mounting TM snapshots using mount_apfs

In my example below, my TM volume is called TM-Duff.

First list the snapshots TM snapshots with:

diskutil apfs listSnapshots /Volumes/TM-Duff

This lists all the snapshots. Here is just one of them:

+-- C67959A1-ACAD-47D9-9FAB-17A9B4988BD8
|   Name:        com.apple.TimeMachine.2024-03-31-192542.backup
|   XID:         2229
|   Purgeable:   Yes

Now it can be mounted using:

mount_apfs -o ro -s com.apple.TimeMachine.2024-03-31-192542.backup /Volumes/TM-Duff ~/Temp/mp

where ~/Temp/mp is an empty directory to use as a mount point. See man mount_apfs for a rather poor description of the command.

Now use ls -l ~/Temp/mp to see the content of the backup. A few folders down the tree:

ls -l ~/Temp/mp/2024-03-31-192542.backup/Data
total 3840
drwxrwxr-x@ 171 root  admin  5472 23 Mar 20:18 Applications
-rw-r--r--@   1 root  wheel     0 24 Mar 20:11 Icon?
drwxr-xr-x@  67 root  wheel  2144  9 Mar 20:12 Library
drwxr-xr-x@   3 root  wheel    96  7 Nov 14:48 MobileSoftwareUpdate
drwxr-xr-x@   3 root  wheel    96 29 Feb 15:05 System
drwxr-xr-x@   6 root  admin   192  9 Mar 20:12 Users
drwxr-xr-x@   2 root  wheel    64 24 Mar 20:04 Volumes
drwxrwxr-t@   2 root  admin    64 11 Jul  2023 cores
drwxr-xr-x@   2 root  wheel    64 11 Jul  2023 mnt
drwxr-xr-x@   3 root  wheel    96 12 Nov 15:26 opt
drwxr-xr-x@   6 root  wheel   192  9 Mar 20:12 private
drwxr-xr-x@   2 root  wheel    64 11 Jul  2023 sw
drwxr-xr-x@   5 root  wheel   160 29 Feb 15:05 usr

(just the same as Finder shows.)

Answer 2

I just ran into the same issue. After some troubleshooting, here's what I found:

The issue here appears to be that the snapshots are mounted automatically in the /Volumes/.timemachine directory, but with the "nobrowse" option, which keeps you from accessing them from the terminal:

The way to mount these in a terminal-accessible format is to unmount the .timemachine ones and remount it yourself:

 ~ % for i in `ls /Volumes/.timemachine/*/*`; do sudo sudo umount $i; done     

Once you've done that, you can now mount it as you'd expect:

mount_apfs -o ro -s com.apple.TimeMachine.2024-07-27-173053.backup /dev/disk7s2 ~/Desktop/rh-restore

The other issue that I ran into is that you need to ensure Terminal has the "Full Disk Access" permission.