APFS Snapshot

An APFS snapshot is a read-only, point-in-time image of an APFS volume. Because APFS is copy-on-write, a snapshot initially costs almost no space: it simply preserves the blocks that existed when it was taken, while later changes are written elsewhere.

macOS creates local snapshots for Time Machine and around software updates, and the booted system itself runs from a snapshot of the sealed system volume. Local Time Machine snapshots can be listed with tmutil listlocalsnapshots / and mounted read-only with mount_apfs -s <snapshot-name> <volume> <mount-point>.

Forensically, snapshots can hold earlier versions of files that have since been modified or deleted. They are purged automatically, often within about 24 hours or under disk pressure, so capture them early. More in APFS snapshots and timestamps.