The mysterious Mac problem that’s hogging up your storage could be snapshots

Over 200GB had disappeared from my Mac's startup volume. It seemed unlikely the external SSD I had just swapped in as my startup drive was shrinking. Instead, it was a snapshot—more accurately, a snapshot for reverting the state of files on my volume or the entire volume to a previous point in time.

Snapshots are a powerful way for backup software to provide a quick point in time to walk back to when you don't necessarily need to restore the entire volume. You might want an earlier version of a file, or the volume might be changed only slightly, making it far faster to use a snapshot to revert it to a previous state. That might happen if you accidentally overwrite a bunch of files or (heaven forbid) you were attacked by ransomware. (Ransomware is a potential risk for Mac users, because of the simple nature of how it works, but there have been no meaningful ransomware malware successes against macOS yet.)

You might encounter snapshots seemingly filling your startup volume from one of two pieces of software:

• Time Machine: Time Machine writes temporary snapshots to the local volume in preparation of copying them to a local or network volume that's not immediately available. This can result in orphaned snapshots. You can use the advice in this column from 2018 which describes how to determine whether these snapshots are in place and offers instructions on deleting them. A Time Machine backup volume also has snapshots that let you revert files or a volume to a particular moment, but those don't occupy space on your startup volume.
• Carbon Copy Cloner: Bombich Software's backup software automatically creates snapshots using a feature in the APFS filesystem when your startup volume is an SSD. Apple started rolling out APFS a few releases of macOS ago. For details on working with CCC's use of APFS snapshots, read on.

Carbon Copy Cloner and snapshots

APFS allows the creation of a snapshot as a sort of fast rewind. Instead of restoring everything on your volume, if you restore from an APFS snapshot, only the changes between the current state of your volume and the state of the snapshot need be applied. The volume rewinds in time to that point.

You can also use the feature to retrieve older versions of a file from the snapshot. Storing snapshots of files is called versioning, and it's available through Time Machine if that backup method is enabled; through apps that support the File > Revert To > Browse All Versions feature, described in this column, which makes a new version for each save and for some auto-save operations; and via sync software like Dropbox, which requires a trip to the website to pull up previous versions.

Snapshots let Carbon Copy Cloner retrieve older versions of files as well as entire volumes.

IDG

Bombich Software recommends snapshots as part of a set of backup methods that can help you get back in action more quickly, and enables the feature by default and only for SSDs. I had just switched from an internal Fusion drive (a tiny SSD plus a large hard disk drive) to an external SSD, which is why I encountered the problem suddenly.

But if you're using Time Machine and Dropbox or some other combination of software that keeps revisions on hand, you don't need these snapshots or can set it to a low number.

In Carbon Copy Cloner > Preferences, uncheck Enable snapshots on APFS-formatted, SSD-backed volumes. After disabling, however, you can select a volume in the sidebar under Volumes and see a list of snapshots and settings to enable or disable snapshots.

Carbon Copy Cloner lets you tweak snapshot settings to avoid retaining too many.

IDG

If you're finding the snapshots are filling your volume too full, as I was, set the free space remaining settings (the bottom of the five settings) to a higher number, like 150GB or 200GB. You can also reduce the number of snapshots made and how long they're retained.

This Mac 911 article is in response to a question submitted by Macworld reader Nick.

Ask Mac 911

We've compiled a list of the questions we get asked most frequently along with answers and links to columns: read our super FAQ to see if your question is covered. If not, we're always looking for new problems to solve! Email yours to [email protected] including screen captures as appropriate, and whether you want your full name used. Not every question will be answered, we don't reply to email, and we cannot provide direct troubleshooting advice.