APFS Snapshots

What a snapshot is

An APFS snapshot is an immutable, point-in-time image of a volume (not the whole container). It works by pinning the volume’s B-tree root at a specific generation. Any block that was allocated at snapshot time cannot be freed as long as the snapshot exists — even if the corresponding file has been deleted in the live volume.

Key insight: the space consumed by a snapshot is not the full volume size. It’s only the blocks that have diverged between the snapshot and the current live state. A snapshot taken 5 minutes ago on a volume where nothing has changed costs essentially nothing. A snapshot taken 6 months ago on an active machine can retain hundreds of GB of blocks for deleted and modified files.

Who creates snapshots

Multiple things create APFS snapshots on a Mac:

Creator	Snapshot name pattern	Visible to tmutil?
Time Machine (local)	com.apple.TimeMachine.YYYY-MM-DD-HHMMSS	Yes
macOS sealed system	com.apple.os.update-<UUID>	No
Carbon Copy Cloner	com.bombich.ccc.<UUID>	No
Arq backup	com.arq.<UUID>	No
Any other backup tool	varies	No

tmutil listlocalsnapshots / only shows snapshots it created (Time Machine snapshots on the Data volume). It is not a complete snapshot inventory.

The complete snapshot inventory

To see all snapshots on a volume, you need diskutil. You must refer to volumes by their device identifier (like disk3s2), which you get from diskutil apfs list:

# First, get the device identifiers for your volumes
diskutil apfs list
# Note the identifiers like disk3s1, disk3s2, etc.
 
# Then list snapshots on each relevant volume
diskutil apfs listSnapshots disk3s2   # replace with your Data volume identifier
diskutil apfs listSnapshots disk3s1   # replace with your System volume identifier

The output shows each snapshot’s name, creation date, and whether it’s purgeable (eligible for automatic eviction under storage pressure). A snapshot marked Purgeable: No is pinned and will not be automatically evicted.

Orphaned snapshots

If a backup application created snapshots and was then deleted without cleanup, those snapshots remain permanently. They are not managed by Time Machine and will never be automatically deleted. They silently consume space equal to all the blocks that diverged between the snapshot date and today.

This is one of the most common sources of large unexplained disk usage.

Snapshot space is invisible to du

There is no path you can cd into to find snapshot-retained blocks. They live in the block layer, below the filesystem tree. The only way to quantify snapshot space consumption is through APFS volume accounting — i.e., diskutil apfs listSnapshots output or Disk Utility’s storage breakdown.

The gap between sudo du -sh /System/Volumes/Data and the Capacity Consumed shown by diskutil apfs list is primarily snapshot-retained space.

See also

• APFS - What It Is — CoW is what makes snapshots cheap
• APFS - Container and Volume Model — snapshots are per-volume
• APFS - Sealed System Volume (SSV) — the com.apple.os.update-* snapshot
• diskutil - The Ground Truth Tool — how to list and delete snapshots
• Diagnostic Playbook - Finding Hidden Space on macOS — orphaned snapshots are often the culprit