Lesson 17

Manage Time Machine

In this lesson, you learn how Time Machine enables you to browse the backup history of a file system. You become familiar with how to configure Time Machine. And you explore ways to recover files from Time Machine backups.

Time Machine also performs local snapshots, which capture your content at a specific time when your external storage device for Time Machine isn’t available. These backups and local snapshots enable you to use Time Machine to restore files even when your external storage device isn’t available. Time Machine keeps:

Hourly backups for the past 24 hours

Daily backups for the past month

Weekly backups for all previous months

Local snapshots as space permits

To make sure that you have storage space when you need it, when your external storage device becomes full, Time Machine deletes the oldest backups. And, Time Machine stores local snapshots only on disks that have plenty of free space. When storage space gets low, Time Machine deletes the oldest snapshots. This is why the Finder, About This Mac, and Get Info don’t include local snapshots in their calculations of available disk storage space.

You can turn off Time Machine and wait a few minutes for macOS to delete local snapshots. When you turn Time Machine back on, it remembers the previous external storage devices you were using.

After you set up Time Machine, it automatically makes hourly backups. Between backups, a background process, like the one Spotlight uses, tracks changes to the original file system. When the next scheduled backup occurs, Time Machine backs up only files that have changed. Time Machine then combines the new content with hard-link file-system pointers (which occupy nearly zero disk space) to the previous backup content and creates a simulated view of the entire file system at that point in time.

Time Machine ignores files that don’t need to be backed up (ones that can be re-created after a restoration) to save space. Generally speaking, Time Machine ignores temporary files, Spotlight indexes, items in the Trash, and anything that can be considered a cache. Time Machine doesn’t back up system log files. Software developers can also instruct Time Machine to ignore specific app data that doesn’t need to be backed up. For example, apps for Internet file storage providers, like Dropbox or OneDrive, can instruct Time Machine to ignore files saved to a cloud service.

Time Machine always ignores files listed in the configuration file StdExclusions.plist, which is stored in /System/Library/CoreServices/backupd.bundle/Contents/Resources.

Some database files appear as large, single files to the file system. Using a database app, a user might edit only a few bytes in a large database file. Even so, Time Machine creates another copy of the entire file. This can fill your external storage device much more quickly than if the database was stored as many smaller files. Check with third-party database app developers, such as FileMaker, Inc., on their recommendations for backing up database files with Time Machine.

Even though Time Machine creates local snapshots, you should also periodically connect your external storage device—that’s configured for Time Machine—to your Mac to back up your files to a location besides your internal disk. If anything happens to your Mac or its internal disk, you can use your external storage device to restore your entire system to another Mac or to a blank replacement disk on your Mac.

When you start a Time Machine backup to an external storage device for the first time.

Every hour after you turn on Time Machine.

An hourly local snapshot is saved for 24 hours. macOS saves Time Machine local snapshots hourly, unless you deselect Back Up Automatically in Time Machine preferences.

Until macOS needs to use the storage space that the local snapshots use.

In this case, Time Machine saves a local snapshot of your last successful Time Machine backup.

Before you install any macOS update, even if you don’t turn on Time Machine.

For more information about local snapshots read Apple Support article HT204015, “About Time Machine local snapshots,” and the tmutil man page.

One that can connect to a USB, FireWire, or Thunderbolt port on your Mac

On a Mac using macOS 10.13 or later: a shared folder configured to be a Time Machine backup destination on your network

An AirPort Time Capsule on your network

One that can be connected to the USB port of an AirPort Extreme Base Station (802.11ac model) or AirPort Time Capsule on your network

Network-attached storage (NAS) device that supports Time Machine over SMB

When you connect an external storage device directly to your Mac, you might be asked if you want to use it to back up your Mac with Time Machine.

If Time Machine doesn’t ask you to select an external storage device when you connect the drive to your Mac:

1. Open Time Machine preferences.

2. Click Select Backup Disk, Select Disk, or Add or Remove Backup Disk.

3. Select an external storage device from the list.

4. Click Use Disk.

The most common format for a Time Machine external storage device that’s connected to a USB, FireWire, or Thunderbolt port on your Mac is Mac OS Extended (Journaled) (HFS Plus Journaled). Time Machine also supports all Mac OS Extended (Journaled) formats and Xsan formats for external storage devices that are attached to a USB, FireWire, or Thunderbolt port on your Mac.

If you select an attached external storage device that doesn’t use one of these supported formats to be your Time Machine backup disk, macOS offers to erase it. If you click Erase, macOS reformats the disk with the format of Mac OS Extended (Journaled).

For additional backup security and convenience, you can repeat the steps from earlier in this lesson to add another external storage device. For example, you might use one external storage device for work and another for home.

Time Machine works best if you use your external storage device only for Time Machine backups. If you keep files on your external storage device, Time Machine won’t back up those files, and there will be less space for Time Machine backups.

You must provide a password and a password hint.

Your backups will be accessible only to users with the password.

macOS reformats the external storage device as Mac OS Extended (Journaled, Encrypted).

When you encrypt your Time Machine external storage device, macOS doesn’t initially save the encryption password. After you eject your encrypted Time Machine external storage device, the next time you connect it, macOS prompts you to enter the password and optionally save it to the keychain system for automatic retrieval.

If the encryption checkbox is dimmed, hover your pointer over it to see an explanation of why. For example, the explanation might say that you must reformat or repartition the selected disk. If no explanation appears, the disk you selected doesn’t support encryption.

If you connect your encrypted external storage device to another Mac, you must enter the password to access the backed-up files.

If you don’t encrypt your external storage device, then the first time you make a Time Machine backup, you’ll see an alert that tells you that your external storage device isn’t encrypted. You can click Settings and then configure your Time Machine external storage device to be encrypted.

Select a network backup disk.

Verify the backup status.

Manually configure backup settings.

Configure the option to show Time Machine in the menu bar.

Configure the option to back up automatically.

You can exclude items from a backup to reduce the backup space you’ll need. Time Machine excludes Time Machine external storage devices from its backups. This prevents multiple external storage devices from backing up each other.

You can drag items into the list field, or you can click the Add (+) button at the bottom of the list to reveal a file browser. This enables you to select folders or volumes to exclude.

If you want Time Machine to back up an external storage device, remove it from the exclude list. To remove an item from the exclude list so that it will be included in the next Time Machine backup, select the item and then click the Remove (–) button. Backups won’t be made until you click Save.

If you want to save space by excluding system items, add /System to the exclude list. You will be prompted to exclude all system files or just /System. However, if you don’t perform a full backup of your system volume, you won’t be able to perform a full restoration of it. Instead, you have to install macOS, and then restore the remainder of your content using Migration Assistant, as covered later in this lesson.

By default, the option “Notify after old backups are deleted” is enabled, so you’ll be notified if your external storage device is full and Time Machine deletes old backups to make space for new Time Machine backups.

1. Open a window for the file that you want to remove from your Time Machine backup.

2. Open Time Machine.

3. Find the file to remove from your Time Machine backup.

4. Control-click the file.

5. Choose “Delete All Backups of filename.”

6. Click OK at the confirmation dialog.

7. If necessary, provide administrator credentials, then click OK.

8. In Time Machine, click Cancel to exit Time Machine.

Your files are no longer available to restore from your Time Machine backup.

Specific files with Time Machine

User accounts and entire home folders with Migration Assistant

An entire Mac with macOS Recovery

Specific files with the Finder

1. Open a window for the file that you want to restore. For example:

   To restore a file you deleted from your Documents folder, open the Documents folder.

   To restore an email, open Mail, then open the mailbox that the email message was in.

   If you’re using an app that saves versions of documents as you work on them, you can open a document and use Time Machine to restore earlier versions of that document.

2. Connect your Time Machine external storage device to your Mac if it’s available.

   Otherwise, Time Machine uses your local snapshots.

   If you back up to multiple external storage devices, you can switch them before you enter Time Machine. Press and hold the Option key, click the Time Machine menu item, then choose Browse Other Backup Disks. In the “Choose Time Machine Disk to Browse” window, select a disk, and then click Use Selected Disk. Time Machine opens, and you can skip to step 4.

3. Open Time Machine with any of the following actions:

   Open Spotlight, enter Time Machine, then press Return.

   Choose Enter Time Machine from the Time Machine menu.

   Click Time Machine if you see its icon in the Dock.

   The following figure shows Time Machine for the Documents folder:

   

4. Find the files to restore:

   Use the timeline on the edge of the screen to see the files in your Time Machine backup as they were at that date and time.

   A bright red tick mark is a backup that can be restored now, either from a local snapshot or from your external storage device. When your external storage device isn’t available, only the local snapshots are bright red.

   A dimmed red tick mark is a backup that can be restored from your external storage device after it becomes available. Until then, the stack of windows on the screen shows a blank window for that backup.

   Use the onscreen up and down arrows to jump to the last time the contents of the window changed. You can also use the Search field in a window to find a file, and then move through time while focused on changes to that file.

5. Select a file and press the Space bar to preview it and make sure it’s the one you want.

6. Click Restore to restore the selected file, or Control-click the file for other options.

If you access a locally attached Time Machine external storage device, the backup files are in the root of the external storage device in a database folder named Backups.backupdb. This folder contains more folders that have the name of each Mac that was backed up to the disk. Inside each Mac folder are folders named using the date and time of each backup. Finally, inside each dated folder are folders representing each backed-up volume.

Remember these things when you access Time Machine backups from the Finder:

You can only read the contents of a Time Machine backup, which has access control entries (ACEs) that deny write access.

If you don’t have file-system permissions to the backup folders, you have to change the ownership or permissions to open the folders in the Finder. You can find out more about changing permissions in Lesson 13, “Manage Permissions and Sharing.”

If you access Time Machine over a network, you must manually connect to the Time Machine share first. Connecting to shares is covered in Lesson 24, “Manage Network Services.” After you’re connected, you must locate the Time Machine backup disk images. They’re at the root of the Time Machine share and are most commonly named Backups. Each Mac computer’s backup is saved as a separate sparse disk image file named with the Mac computer’s sharing name.

1. When Migration Assistant opens—either during the initial Setup Assistant or when you open it—choose to restore from a Time Machine backup.

   Initial Setup Assistant is covered in Reference 3.1, “Configure a Mac with a New Installation of macOS Mojave.”

   

2. Select an external storage device and authenticate to access its content.

   The remainder of the Migration Assistant process is like the standard migration process covered in Lesson 3, “Set Up and Configure macOS,” for settings, or in Lesson 8, “Manage User Home Folders,” for user-specific items.

Restoring erases the destination disk.

If you’re setting up a new Mac or a Mac with a new installation of macOS Mojave, then you should use Migration Assistant instead of restoring from Time Machine.

To restore just individual files, settings, or user accounts, use Time Machine in the Finder instead of restoring your entire Mac from Time Machine backup.

To completely restore your entire startup disk from either a Time Machine external storage device or a local snapshot:

1. Start your Mac from macOS Recovery.

   You can start up your Mac using the normal macOS Recovery techniques, as covered in Lesson 5, “Use macOS Recovery.”

2. Select Restore From Time Machine Backup in the macOS Utilities window and click Continue.

3. In the “Restore from Time Machine” screen, read the important information on screen, then click Continue.

4. In the “Select a Restore Source” screen, select the disk that contains the Time Machine backup or the Time Machine local snapshot you want to restore to your startup disk.

5. Do one of the following:

   If the disk you selected isn’t locked, click Continue and proceed to step 7.

   If the disk you selected is locked, click Unlock and continue to step 6.

6. If there are multiple users on the external storage device, click the menu and choose a user.

   Enter the password for the user to unlock the external storage device, then click Unlock.

   Select the disk you just unlocked, and click Continue.

7. Do one of the following:

   If you selected a Time Machine local snapshot, then in the “Select a Local Snapshot” screen, select a local snapshot and click Continue. Proceed to step 8.

   If you selected a Time Machine external storage device, then in the “Select a Backup” screen, select a backup and click Continue. Proceed to Step 8.

8. In the “Select a Destination” screen, select your startup disk that will be erased and restored.

9. Click Restore.

10. At the confirmation dialog, click Erase Disk.

The disk you restore is erased before it receives macOS and the other contents of your Time Machine backup. All changes you made to your startup disk after the Time Machine backup or Time Machine local snapshot was taken are lost.

For more information, read Apple Support article HT203981, “Restore your Mac from a backup.”

In this exercise, you configure Time Machine to back up your user home folders to your external storage device.

1. Log in as Johnny Appleseed.

2. Open System Preferences, and click Time Machine.

3. Click the lock button, and authenticate as Local Administrator.

4. Select the “Show Time Machine in menu bar” checkbox if it isn’t selected.

5. Click the Options button to reveal a dialog that enables you to exclude folders from backups.

   There might be an entry for /Users/Shared/adi in the exclude list. This is used internally by Apple Books, and you can ignore it.

6. Click the Add (+) button at the bottom of the list.

7. Navigate to your startup volume (generally Macintosh HD), and select the Applications, Library, and System folders.

   You can Command-click folders to add them to the selection.

   

8. Click Exclude.

9. When you see the message “You’ve chosen to exclude the System folder,” click Exclude All System Files.

   

   Your exclusion list now looks like the following figure (although the sizes may be different, /Users/Shared/adi might be listed, and the option to back up while on battery power appears only on laptop computers).

   

10. Click Save.

1. Connect your external storage device to the Mac.

2. If a dialog appears and asks if you want to use the disk to back up with Time Machine, click Decide Later so that you can configure the backup manually.

3. If your external disk isn’t currently named Backup, select it, choose File > Rename, and type Backup to rename the disk.

4. In the Time Machine pane of System Preferences, select the Back Up Automatically checkbox.

   A dialog appears with a choice of backup targets.

5. Select the external volume named Backup.

   

   Note the “Encrypt backups” checkbox that enables you to encrypt backups. When you select this checkbox, you encrypt the backup volume the same way you would encrypt it in the Finder.

6. Click Use Disk.

   If your external storage device is formatted as APFS, FAT32, or another file system, a dialog appears and asks if you are sure that you want to erase the backup disk. The dialog shows the current destination selected having an incompatible file system. Time Machine destinations must be formatted as Mac OS Extended (Journaled) or HFS Plus using the GPT partition scheme. Destinations formatted with other file system schemes—besides Mac OS Extended (Journaled)—are incompatible and are erased and formatted as HFS Plus for use with Time Machine.

   

7. If you want to continue, click Erase, and authenticate as Local Administrator.

   You see a “preparing disk” message. The Backup disk unmounts, formats as HFS Plus (Journaled), and reappears. Time Machine starts backing up in two minutes. You don’t have to wait for it before proceeding with the exercise.

8. Open Disk Utility, and in the sidebar, select Backup.

   The Backup volume is formatted as Mac OS Extended (Journaled).

   

9. Quit Disk Utility.

10. Quit System Preferences.

11. After the backup begins, you might see a notification that the Backup isn’t encrypted. Close this notification.

    

Now, perform Exercise 17.2, “Restore Using Time Machine,” to test the backup.

In this exercise, you learn how to use Time Machine to recover lost files from the backup.

1. Log in as Johnny Appleseed.

2. Click the Time Machine menu bar item. If the menu indicates that the backup is still in progress, wait for it to finish.

   

3. When you are notified that the backup is finished, click Close.

   

1. In the Finder, open /Users/Shared/ParticipantMaterials/Lesson17.

2. Move the “Archived announcements” folder to the Trash.

   This folder contains the Pretendco company’s old media information.

3. If you are prompted to, authenticate as Local Administrator.

4. Choose Finder > Empty Trash. In the confirmation dialog, click Empty Trash.

1. Choose Time Machine > Enter Time Machine.

   Time Machine opens and shows successive snapshots of your files with more recent ones in front of older ones, which appear to recede into the past.

2. Enter SSED plans in the Search field at the upper right of the window.

   No matching files appear, since the only match was in the folder you deleted and you are viewing files as they exist now.

3. Use the up and down arrows to navigate through time until the file SSED plans.rtf appears.

   You can also navigate through time using the timeline along the right side of the screen.

   

4. Select SSED plans.rtf and press Command-Y or the Space bar.

   A Quick Look preview opens. Quick Look is available in Time Machine so that you can verify that you have the right file before you restore it.

   

5. Press Command-Y, or the Space bar, to close Quick Look.

6. With the file selected, click Restore.

   Since the folder the file was in was deleted, Time Machine gives you the option to re-create the original enclosing folder or choose a new location for the restore.

   

7. Click Choose Location. The Choose Folder dialog opens.

8. Navigate to your Documents folder by selecting it in the sidebar, and click Choose.

9. If you are prompted, authenticate as Local Administrator.

10. In the Finder, navigate to your Documents folder (choose Go > Documents, or press Shift-Command-O).

    The restored SSED plans.rtf file is visible.

1. In the Finder, open the volume you chose to back up to.

2. Open the Backups.backupdb folder. In this folder is a folder for your client. Open it.

   The folder contains one or more snapshot folders, named with the date and time they were taken. There is an alias named Latest that points to the latest backup.

   

3. Browse through these folders: /Backups.backupdb/Mac-NN/Latest/Macintosh HD/Users/Shared/ParticipantMaterials/Lesson17/Archived announcements/2010/04-April.

4. Drag a copy of SSED plans.rtf to your desktop.

5. If prompted, authenticate as Local Administrator.

6. Select the Backup volume on your desktop, Control-click it, and choose Eject “Backup.”

7. Unplug the external storage device from your Mac.