Time Machine in Big Sur - Does it works differently? "Macintosh HD" gone, just "Macintosh HD - Data" showing

[ballpointmusic]

Hello, I did search around a bit, but I have not been able to find an answer. So here it comes:

I recently did a fresh intall of Big Sur on a 16" Macbook Pro. Totally worth it in terms of performance. Since it's 2021, I decided to also start fresh in terms of back ups, and I got a new external hard drive for this purpose.

Normally, I would have expected to find both "Macintosh HD" and "Macintosh HD - Data" as the backed up volumes. However, this is not the case. It's just the one drive. Pic below with hidden files visible.

Howeeeever, there's a catch:

1. When erasing the disk for my clean install, I did erase the entire storage container (APPLE SSD AP0512N). I have done this before without any ill effects. The disk was renamed to 'Untitled'.
2. Upon reinstalling everything, I renamed the disk to 'Macintosh HD' in Finder, as per usual instructions.
3. A disk named Untitled- Data was also created, which I have renamed to Macintosh HD - Data. Now my structure in Disk Utility looks like this ("Show All Devices" enabled):

My sense is that Big Sur only backs up the "Data", and saves the system snapshot instead of "Macintosh HD". Or am I completely wrong and I have to start from scratch?

Any insights much appreciated.

 

[gilby101]

That all looks normal to me. The "Macintosh HD" volume is created by macOS install and is read-only (except for macOS updates) so there is no need for it to be included in TM backup. As you have discovered TM only backs up the Data volume. Disaster recovery will recreate the read-only volume by downloading it from Apple. Whether that is desirable is another question.

 

[Apple_Robert]

I really don't understand why Apple removed the ability to restore from Time Machine with the M1, provided the backup drive was formatted to APFS.

 

[ballpointmusic]

That all looks normal to me. The "Macintosh HD" volume is created by macOS install and is read-only (except for macOS updates) so there is no need for it to be included in TM backup. As you have discovered TM only backs up the Data volume. Disaster recovery will recreate the read-only volume by downloading it from Apple. Whether that is desirable is another question.

Thanks, and I suppose you are absolutely right.

The strange thing, to me, is the fact that I was used to Time Machine creating two disks in my backups folder (precisely, Macintosh HD and Macintosh HD - Data). But, indeed, if there is a system snapshot available there, there is probably no need to backup the former, as you say.

It is just surprising because, in recovery mode (for a potential "restore from time machine" scenario, only backups from Macintosh HD - Data are made available.

 

[CJ Dorschel]

Ugh Time Machine has been a mess since Catalina. I've been using it since day 1 with .Mac and iCloud. Now you cannot open Contacts or Mail to recover individual contacts or emails, etc that were accidentally lost/deleted. Many of us have filed bug reports with Apple who claims it's a bug while then stating recovery is now only possible with a full restore of Mail, Contacts, etc. which defeats one of the great features of Time Machine. Opening a core app and going back in time to recover a lost item has saved me so many times. Restoring an entire backup of Contacts or Mail means I will lose new data even from iCloud as I tried during development and my Mac Pro would update TO iCloud and overwrite the data - syncing is messed up. Why has Apple completely ruined one of the best features of OS X?

 

[ItWasNotMe]

It seems impossible to delete anything nowadays

A. The right click options when an item is selected in TM itself have disappeared
B. I tried deleting an entire backup from Finder.

• It disappeared from the list of backups
• The space was not recovered, from memory Disk Utility showed it as 'Other Volumes'
• Next time I rebooted the machine, it was back in the list of backups

 

[posguy99]

Ugh Time Machine has been a mess since Catalina. I've been using it since day 1 with .Mac and iCloud. Now you cannot open Contacts or Mail to recover individual contacts or emails, etc that were accidentally lost/deleted.

But you don't let Apple services be authoritative for this information, right? I learned this LONG AGO.

 

[Neophyte_FL]

Ugh Time Machine has been a mess since Catalina. I've been using it since day 1 with .Mac and iCloud. Now you cannot open Contacts or Mail to recover individual contacts or emails, etc that were accidentally lost/deleted. Many of us have filed bug reports with Apple who claims it's a bug while then stating recovery is now only possible with a full restore of Mail, Contacts, etc. which defeats one of the great features of Time Machine. Opening a core app and going back in time to recover a lost item has saved me so many times. Restoring an entire backup of Contacts or Mail means I will lose new data even from iCloud as I tried during development and my Mac Pro would update TO iCloud and overwrite the data - syncing is messed up. Why has Apple completely ruined one of the best features of OS X?

We are again in violent agreement on the same issue. Problem still exists after upgrading to 11.1. So I talked to a T2 rep. They must have been having a bad hair day, because I was tersely told it's not an OS issue so further diagnostics serve no purpose even though the retrieve process gets a little closer to success, the engineers are aware of it, so wait for an update to correct the problem, and have nice day.

 

[halofan56]

Hello, I did search around a bit, but I have not been able to find an answer. So here it comes:

I recently did a fresh intall of Big Sur on a 16" Macbook Pro. Totally worth it in terms of performance. Since it's 2021, I decided to also start fresh in terms of back ups, and I got a new external hard drive for this purpose.

Normally, I would have expected to find both "Macintosh HD" and "Macintosh HD - Data" as the backed up volumes. However, this is not the case. It's just the one drive. Pic below with hidden files visible.

View attachment 1709682

Howeeeever, there's a catch:

1. When erasing the disk for my clean install, I did erase the entire storage container (APPLE SSD AP0512N). I have done this before without any ill effects. The disk was renamed to 'Untitled'.
2. Upon reinstalling everything, I renamed the disk to 'Macintosh HD' in Finder, as per usual instructions.
3. A disk named Untitled- Data was also created, which I have renamed to Macintosh HD - Data. Now my structure in Disk Utility looks like this ("Show All Devices" enabled):

View attachment 1709685

My sense is that Big Sur only backs up the "Data", and saves the system snapshot instead of "Macintosh HD". Or am I completely wrong and I have to start from scratch?

Any insights much appreciated.

You are only going to see Macintosh HD-Data. Time Machine only copies " Macintosh HD-Data Volume.

 

[ItWasNotMe]

You are only going to see Macintosh HD-Data. Time Machine only copies " Macintosh HD-Data Volume.

But typical Apple confusion 'Data' includes the Applications. Doh!

 

[ItWasNotMe]

When it's cleaning, it also seems to have changed the pattern of what is kept. When I look at the history via Finder, since sometime around the 8th January, the backup that has been kept for each day is not the earliest that was originally created on that day

[Edit: Same is true looking in Time Machine itself]

 

[gilby101]

When I look at the history via Finder, since sometime around the 8th January, the backup that has been kept for each day is not the earliest that was originally created on that day

Certainly a different retention algorithm. My observation suggests that daily backups are now spaced not more than 24 hours apart. Each daily backup is about 60 minutes (sometimes about 120 minutes) earlier in the day than the previous day. This has the odd side effect that there will be the occasional day with 2 retained backups (one just after midnight and then one just before midnight).

I don't really have enough history to be certain of this, but I suspect the weekly retention is now not more than 7 days. For example, I have weeklies for 2020-12-02 02:56 and 2020-12-08 14:57 - 6 calendar days apart but about 6 and half days when time of day is considered.

 

[CJ Dorschel]

You are only going to see Macintosh HD-Data. Time Machine only copies " Macintosh HD-Data Volume.

Not true. It copies both. Time Machine since Catalina has become a mess. I'm reverting my systems back to Mojave. I spent 5 hours yesterday with tier support - again - and they don't have any answers. Apple really needs to overhaul OS X - oh sorry, macOS. Wait, they did, Big Sur, and that's even more of a mess. It's a shame as OS X used to be solid. It's still better than Windows for my personal needs but not by much anymore.

 

[gilby101]

Not true. It copies both.

For 10.15, TM copies both. But with macOS 11, TM only copies the Data volume.

And Time Machine in general is much improved in macOS 11. Just give it a new partition/container and let it do its thing.

 

[ItWasNotMe]

For 10.15, TM copies both. But with macOS 11, TM only copies the Data volume.

And Time Machine in general is much improved in macOS 11. Just give it a new partition/container and let it do its thing.

Disagree with the improvement statement, for example

Backups more than 24 hours old

• Previously - simple rule - its the first backup of the day
• Now - its at some random point during the day

To my mind makes retrieval of the right version more difficult, especially for files that change every day

 

[CJ Dorschel]

For 10.15, TM copies both. But with macOS 11, TM only copies the Data volume.

And Time Machine in general is much improved in macOS 11. Just give it a new partition/container and let it do its thing.

Please don’t tease! If this is true you just made my year. As a developer I beta tested it but never got a chance to fully try out time machine. I had read from other developers that it hadn’t changed. I hope that’s not the case.

fingers crossed!

 

[gilby101]

Backups more than 24 hours old

• Previously - simple rule - its the first backup of the day
• Now - its at some random point during the day

I am sure there are different points of view on the change to backup retention (I am neutral). But it is not a random time during the day. Have a look at your TM disk with Finder and read my earlier post about backup retention.

 

[leman]

Time machine has received a dramatic overhaul in 11. It now uses APFS snapshots, which makes it much quicker and more reliable.

As to Data vs. System volume, the Data volume is the only one writeable by the user. It makes no sense to backup the system volume since it’s a frozen, Apple controlled snapshot anyway.

 

[CJ Dorschel]

Time machine has received a dramatic overhaul in 11. It now uses APFS snapshots, which makes it much quicker and more reliable.

As to Data vs. System volume, the Data volume is the only one writeable by the user. It makes no sense to backup the system volume since it’s a frozen, Apple controlled snapshot anyway.

Unfortunately some third-party apps require access to root. TotalSpaces is an app that brings back the older gridlike “Spaces” i use so I disable Gatekeeper and SIP. However, no one should do so unless they know exactly what they’re doing. I’ve worked in tech/cyber sec and have been an OS X user since day 1 (still love Snow Leopard - sigh) so I take other precautions but for the most part Apple’s security measures are more of a PITA for developers and users who need access. During Big Sur development we found security issues with SSV that haven’t been resolved. It’s truly baffling - separating boot volumes in Catalina thus producing two Applications folders that appear unified to users has been a headache especially for novice users I’ve helped and SSV is a joke.

Since I rw mount both volumes in Catalina and Time Machine backs them both up I don’t understand how this allegedly is the reason users cannot use Time Machine to recover deleted emails and contacts, etc as we used to. I spent time with engineers again today and they’re back to acknowledging it’s a bug since 10.15 they’re “working on.

sigh

I long for the days when OS X was on a two to three-year release cycle and required developers to install new betas every two weeks on a wiped Mac to ensure the core OS was properly debugged while also ensuring our apps worked. I’d rather spend $129 every 2 to 3 years for a solid OS then a free annual one. I miss Betrand Serlet.

 

[ItWasNotMe]

I am sure there are different points of view on the change to backup retention (I am neutral). But it is not a random time during the day. Have a look at your TM disk with Finder and read my earlier post about backup retention.

Random in the sense of unpredictable, it might be the first backup, the last or more likely somewhere in the middle

 

[leman]

Unfortunately some third-party apps require access to root. TotalSpaces is an app that brings back the older gridlike “Spaces” i use so I disable Gatekeeper and SIP. However, no one should do so unless they know exactly what they’re doing.

Those apps are essentially hacking the OS and are a security and stability nightmare. If one wants to tweak the OS in that way, Mac is simply the wrong choice. IMO, There is no reason whatsoever for a user to have write access to the base system on a consumer-targeted machine, unless you are a kernel developer or a security researcher.

I am sure that there are still gaps and issues with Apple’s implementation, but so far, Catalina abs Bug Sur have been working marvelously for me. In old good days you mention (slower development cycles, paid upgrades), I had many more issues with stability than I have now.

 

[CJ Dorschel]

Those apps are essentially hacking the OS and are a security and stability nightmare. If one wants to tweak the OS in that way, Mac is simply the wrong choice. IMO, There is no reason whatsoever for a user to have write access to the base system on a consumer-targeted machine, unless you are a kernel developer or a security researcher.

I am sure that there are still gaps and issues with Apple’s implementation, but so far, Catalina abs Bug Sur have been working marvelously for me. In old good days you mention (slower development cycles, paid upgrades), I had many more issues with stability than I have now.

They're not hacking the OS. Apple locked down root access with SIP and now SSV. TotalSpaces worked fine before SIP was introduced. Working in cyber sec, SIP and SSV are a joke and buzzwords meant to give users a false sense of security. As I stated, there are still opened and unresolved SSV issues many of us found during development - bypassing these measures are not difficult and can be done remotely which is why your primary concerns should be point of entry - network/LAN/etc - for any novice user. Claiming such apps "hack" into systems and pose major security issues would place companies that sell such in legal jeopardy and last I checked BinaryAge (who also produces TotalFinder) and other larger companies don't have large scale law firms on retainer as they don't need it. More to the point, Apple would have shut them down long ago. Gatekeeper, SIP, SSV - you're better off having a complex user password.

Point of fact: Apple could have easily implemented a base sec system that locked the system library while still allowing third party apps the access they require. They don't require FULL access to root, only to specific non-system folders that Apple had always allowed access to for years without problem. In essence, the security measures Apple implemented don't ensure more security on a XNU based system, it just means users need to use the Mac App Store and increase Apple's developer take unless they know what they're doing and bypass it. I don't know a single sec pro who doesn't disable SIP and SSV the second they load up a new system.

In the "old days", I worked with then head of engineering Bertrand Serlet who also oversaw Apple's transition to Intel with 10.4 - 10.6. Those were rock solid releases. There is a reason true debugging requires wiping a system with each release as third party apps and plugins can interfere with debugging the core OS. Cook simply wanted to attract developers to the Mac ecosystem and Mac App Store by including OS X/macOS development with iOS at the $99 annual fee on an annual release cycle. Serlet left over disagreements with Cooks direction as he worked on 10.7 as well before Federighi took over and at that time Jobs already handed control over to Cook as he stayed on to launch his true project, the iPad. By 2009 Cook was running the show.

Bertrand Serlet, one of the major forces behind OS X, to leave Apple

Bertrand Serlet, senior vice president of Mac Software Engineering and one of the developers of OS X, is leaving Apple after a 22-year working relationship with Steve Jobs. Serlet started working with Jobs in 1989 as part of NeXT and made the move to Apple in 1997 when Jobs returned to the...

www.engadget.com

I will give you one thing: Bug Sur is an appropriate name.

Can we please stay on topic and leave off-topic opinions - off topic? Thanks!

UPDATE: I have since loaded Big Sur 11.2 RC on a MacBook I use for side projects and attached a USB drive for Time Machine. The same issues we're all experiencing remain. Worked with Apple engineering again today and they fully acknowledge the matter and are still "working on it". None of it relates to Apple's changes in Catalina and Big Sur. I finally was able to pry some info out and apparently Apple - whether this is Cook or Federighi - has been wanting to push cloud services into backups now. Apparently, with iCloud storage increasing and Apple's mobile marketshare (iDevices and MacBooks) being their strongest, after Apple left the networking market by discontinuing their AirPort line which included Time Capsules and local backups Apple is pushing into cloud backups. This is why retrieving emails and contacts in Time Machine was removed as Apple worked more on APFS with Time Machine (which makes little sense as APFS is streamlined for SSD and most use 4+ TB HDD's for Time Machine and backups thus APFS is sorely inefficient with Time Machine and one of the reasons Apple finally ditched Fusion Drives). Apparently they want users to retrieve data over the cloud but in the interim they removed the ability to do so locally. Now they're backpedaling and adding the ability back into Time Machine but it won't be for a while.

Sidenote: I can't believe they also removed cloning. Yes, Time Machine once produced a full clone of your drive allowing a backup without a lengthy restore. Now that issue is due to Apple's decision on locking root and creating a user and system drive. What a mess.

 

[leman]

@CJ Dorschel First of all, let me make it clear that I am not doubting your credentials or the fact that you have infinitely more experience on these matter than I ever will. By discussing these things with you, I don't mean any disrespect, I just think that you are focusing too much on certain details which may be less important to the overall picture

They're not hacking the OS. Apple locked down root access with SIP and now SSV. TotalSpaces worked fine before SIP was introduced.

Applications like TotalSpaces, TotalFinder (and others) rely on undocumented API, dynamic API hijacking and alteration of system configuration, among other things. Hacking the OS in this sense means — using the available interfaces in the ways not anticipated or supported by Apple.

Working in cyber sec, SIP and SSV are a joke and buzzwords meant to give users a false sense of security. As I stated, there are still opened and unresolved SSV issues many of us found during development - bypassing these measures are not difficult and can be done remotely which is why your primary concerns should be point of entry - network/LAN/etc - for any novice user.

Ah, but I don't really see these things as "hard security" measures. For me, SIP and friends are about system stability and improved ergonomic. Locking the system volume prevents accidental deletion or alteration of important stuff that no user should be tinkering with anyway. It also simplifies maintenance and allows Apple to implement tings in a more efficient way (monolithic system library caches, potentially quicker system updates etc.).

In essence, the security measures Apple implemented don't ensure more security on a XNU based system, it just means users need to use the Mac App Store and increase Apple's developer take unless they know what they're doing and bypass it.

I don't see what Apple's restriction have to do with Mac App Store. You can download signed programs from everywhere, and even unsigned apps are not a problem — it just takes a single right click to start them. I am actually surprised that you are using this rhetorics. They definitely improve the baseline security of the average user, who can have a certain peace of mind, and they do not impact a more advanced user who still has all the flexibility they need. Except of course tinkering with the base system, but frankly, if that's what you want, you should't be using Apple products. Linux is out there as well.

In the "old days", I worked with then head of engineering Bertrand Serlet who also oversaw Apple's transition to Intel with 10.4 - 10.6. Those were rock solid releases.

Maybe they were, these are exactly the versions where Safari and Mail would crash for me daily — across different machines, making them unusable, and I had to run "repair permissions" at least once per month to resolve weir beach ball issues. The experience was still much better than Windows, but I am very skeptical about the myth of "old good days". People love to praise Snow Leopard as the "best, most stable OS X Apple ever released", while conveniently forgetting that initial 10.6 had a critical bug that could delete your data.

... Apple worked more on APFS with Time Machine (which makes little sense as APFS is streamlined for SSD and most use 4+ TB HDD's for Time Machine and backups thus APFS is sorely inefficient with Time Machine and one of the reasons Apple finally ditched Fusion Drives).

Again, I am surprised that an expert like you would write something like this. The reason to use APFS for backups is because APFS supports snapshotting. The old Time Machine was using a complicated hack of hard links (which were not even natively supported by HFS!) to make incremental backups — a tedious and error-prone enterprise which resulted in a lot of complains about Time Machine speed and stability. In particular, backup verification was a nightmare. The "new" Time Machine works by synchronizing the filesystem structures — which is faster and much more reliable. That APFS is optimized for SSDs doesn't matter for this application.

Sidenote: I can't believe they also removed cloning. Yes, Time Machine once produced a full clone of your drive allowing a backup without a lengthy restore. Now that issue is due to Apple's decision on locking root and creating a user and system drive. What a mess.

It's because they are now only backing up the data volume. Which by the way is a true filesystem-level clone now, not a weird chaos of fragile file links. SSV makes it unnecessary to backup the system volume since it's immutable anyway.

Apparently they want users to retrieve data over the cloud but in the interim they removed the ability to do so locally.

Yeah, the last couple of years were marked by some weird managerial decisions and uncertainty. I certainly agree with you on this one. Judging by the latest developments, it seems to me like they are getting their stuff together though. Let's hope for the best.

 

[Ayrehead]

Thank you all for the info in this thread, it explained why I saw unexpected things after backing up with TM in Big Sur. Now I understand that TM only backs up the Data volume. There is one more strange thing. The size of my backup is much smaller than the Data volume. I looked with Terminal diskutil, and disk utility app, and finder and they all closely agree:

Internal drive volumes
Big-sur - Data 25.65 GB
com.apple.update-... 15.31 GB

External drive volume with the backup
backup-big-sur 14.47 GB

Is it compression? I would not expect it to be that much. Or something about "firmlinks" (which I don't understand) that create phantom files?

 

[leman]

Thank you all for the info in this thread, it explained why I saw unexpected things after backing up with TM in Big Sur. Now I understand that TM only backs up the Data volume. There is one more strange thing. The size of my backup is much smaller than the Data volume. I looked with Terminal diskutil, and disk utility app, and finder and they all closely agree:

Internal drive volumes
Big-sur - Data 25.65 GB
com.apple.update-... 15.31 GB

External drive volume with the backup
backup-big-sur 14.47 GB

Is it compression? I would not expect it to be that much. Or something about "firmlinks" (which I don't understand) that create phantom files?

Do you have exclusions set up? Time Machine does not backup caches or other temporary data. It is possible that this is what you see. Also, it is possible that Apple does some sort of data deduplication... we don't really know how current TM works exactly.