In yesterday’s article, I showed how I was able to restore a trashed APFS volume using a snapshot. The main lesson is that, while this is superbly quick and essentially simple, only a very limited number of backup apps are currently able to make snapshots. Restoring from a snapshot is thus only normally available to those volumes which are already being backed up. This article explains why that is.
Snapshots take advantage of the way in which APFS uses its copy on write feature with changing file contents. When changed data are written out to an existing file, it’s written not to the block containing the original data, but to a different block. Not only that, but APFS only writes out as much new data as it needs to.
Let’s say that our original document is stored in two blocks, and we make changes which affect only the contents of the second.
Instead of APFS writing out new versions of each of those blocks, it only writes the changed block, and the new file is then composed of one new and one old block. So long as all three blocks are kept in storage, the file system can readily deliver either the original or the changed version of that file.
Read more at EclecticLight.co