Snapshots for volume backups are often the culprit.
Over 200GB had disappeared from my Mac’s startup volume. It seemed unlikely the external SSD I had just swapped in as my startup drive was shrinking. Instead, it was a snapshot—more accurately, a snapshot for reverting the state of files on my volume or the entire volume to a previous point in time.
Snapshots are a powerful way for backup software to provide a quick point in time to walk back to when you don’t necessarily need to restore the entire volume. You might want an earlier version of a file, or the volume might be changed only slightly, making it far faster to use a snapshot to revert it to a previous state. That might happen if you accidentally overwrite a bunch of files or (heaven forbid) you were attacked by ransomware. (Ransomware is a potential risk for Mac users, because of the simple nature of how it works, but there have been no meaningful ransomware malware “successes” against macOS yet.)
You might encounter snapshots seemingly filling your startup volume from one of two pieces of software:
- Time Machine: Time Machine writes temporary snapshots to the local volume in preparation of copying them to a local or network volume that’s not immediately available. This can result in orphaned snapshots. You can use the advice in this column from 2018 which describes how to determine whether these snapshots are in place and offers instructions on deleting them. A Time Machine backup volume also has snapshots that let you revert files or a volume to a particular moment, but those don’t occupy space on your startup volume.
Read more at MacWorld.com