Time Machine Recovery

Time Machine Recovery investigates full or unavailable backup destinations, including volumes that remain full while Finder shows no completed backups. It separates snapshot usage, live backup files, destination availability, and permissions before selecting a recovery step. Recovered capacity and a successful new backup are reported as distinct results.

The diagnosis starts with destination information, backup status, and recent unified logs narrowed to the latest attempt and failure phase. A read-only log query is:

/usr/bin/log show --last 2h --info --style compact --predicate 'subsystem == "com.apple.TimeMachine"'

For local storage, inspect external disks, volume information, and free space. Record the destination UUID and sibling partitions, then confirm the current target before every mutation. Network destinations instead require mount, connectivity, and server-quota checks. The local APFS cleanup procedure does not apply to them.

Use this skill when Time Machine reports a full or unavailable destination, or when completed backups appear absent despite substantial disk usage. Distinguish the minimum free space logged before copying from the actual capacity the backup needs. Automatic thinning preserves the last completed backup, so the snapshot list must be interpreted alongside Finder or an accessible backup listing.

When Finder omits completed backups but the volume remains full, measure live files in a Terminal with Full Disk Access. Wait for the scan's final total and prompt before interpreting partial output. Incomplete, interrupted, and previous-backup directories may explain usage hidden from Finder's Time Machine view. If access is blocked, the user can run the read-only scan locally and provide its output.

Inputs include the verified destination, status and log evidence, snapshot inventory, measured directory usage, available privileges, and permission for cleanup. When evidence shows incomplete leftovers and Time Machine is idle, consult the installed manual before scoped incomplete-backup deletion. Explain that the operation discards incomplete data and may revert an APFS destination to its last backup. Root and Full Disk Access are required; the machine-directory argument depends on the confirmed layout.

Monitor the process and free space until it finishes. Large deletions can be silent while capacity increases. Assess the final message, exit status, remaining files, and measured space together, since reported deletion can coexist with a nonzero exit. Fresh listings can distinguish backup data from Spotlight indexing.

If unexplained usage persists, recheck snapshots and files, then use read-only filesystem verification or First Aid on the selected volume. Keep permission errors separate from disk faults. Recursive removal of backup internals is not the default. Erasure requires explicit authorization for the verified volume and respect for sibling-partition preservation.

With sufficient capacity, start or guide a fresh backup and verify its new completed timestamp. If it fails, inspect the latest logs. Free space alone does not establish working backups.

The workflow uses macOS Time Machine utilities, Disk Utility, Finder, unified logs, and APFS inspection tools. Apple's backup troubleshooting and First Aid guidance support checking behavior for the installed macOS version.