Restore hidden files from Time Machine

About backups

A working backup is like a stock of 10 billion masks waiting for a pandemic. You only use it when things go bad and since you never know when things go bad your backup needs to work flawlessly all the time.

Time Machine makes it extremely easy to restore anything that's on the backup disk to your machine. If you have not yet installed an external drive for your Time Machine backups, do it NOW. There is nothing more important than having a reliable backup of all your important files.

Time Machine has an optional setting (System Preferences > Time Machine > [Options...] button) where you decide what not to backup. Anything that is not there is basically copied to the Time Machine disk.

Hidden files are also hidden in Time Machine

This is not a Time Machine tutorial, so I'll stop here. But, what matters is that when you click on the "Enter Time Machine" menu item, macos shows a nice time based display of the contents of the current window, but it only shows what is visible. Not hidden files that are used in Unix applications as preference files and that are routinely created at the root of your home folder.

Yesterday I messed with one such file and since it was hidden, I could not restore it from the Time Machine display.

The easy way, for moderately experienced people

Time Machine can be accessed from the command line with the tmutil command.

$ man tmutil

TMUTIL(8)                 BSD System Manager's Manual                TMUTIL(8)

     tmutil -- Time Machine utility

     tmutil verb [options]

     tmutil provides methods of controlling and interacting with Time Machine,
     as well as examining and manipulating Time Machine backups.
     Common abilities include restoring data from backups, editing exclusions,
     and comparing backups.

The "verb" we're looking for is restore and its syntax is:

restore [-v] src ... dst
        Restore the item src, which is inside a snapshot, to the location dst.
        The dst argument mimics the destination path semantics of the cp tool.
        You may provide multiple source paths to restore. The last path
        argument must be a destination.

The src is where the restore date/time can be chosen since the backups have their own folders based on date/time.

So what I needed was:

$ tmutil restore /Time/Machine/path/to/.hidden.file ~/.hidden.file.test

I restored to a .test file just to make sure that really was the file I wanted.

The longer road, a half command-line, half GUI approach

Another solution is to make hidden files visible in Finder, start Time Machine, restore from the graphical interface and re-hide the files (they're hidden to avoid messing with them by accident).

There is no visible Finder setting that allows for that, so to get the job done one still has to use the command line to modify some non-GUI Finder setting from Terminal. This has been documented for years but I keep forgetting about it.

In Terminal, enter the following command:

$ defaults write AppleShowAllFiles TRUE

What does all that mean ?

In Terminal, enter the following comment:

$ man defaults

To display the "defaults" command "man"ual. You should see:

DEFAULTS(1)               BSD General Commands Manual              DEFAULTS(1)

    defaults -- access the Mac OS X user defaults system

    defaults [-currentHost | -host hostname] read [domain [key]]
    defaults [-currentHost | -host hostname] read-type domain key
    defaults [-currentHost | -host hostname] write domain { 'plist' | key 'value' }
    defaults [-currentHost | -host hostname] rename domain old_key new_key
    defaults [-currentHost | -host hostname] delete [domain [key]]
    defaults [-currentHost | -host hostname] { domains | find word | help }


Do you see the "defaults [-currentHost | -host hostname] write domain { 'plist' | key 'value' }" line ?

What that means is that the command syntax is:

defaults + optionally either "-currentHost" or "-host hostname" + write + the "domain" to which belongs the preference + a compulsory settings value.

In our case, the "domain" is "", the "key" is "AppleShowAllFiles" and the "value" is "TRUE".

which means "Please, write down somewhere that Finder is now required to show all the files."

Next step

When you're done with your un-hiding hidden files, you can enter Time Machine, restore the file you want and then re-hide the hidden files with:

$ defaults write AppleShowAllFiles FALSE

Et voilà !

Now, Finder doesn't know about that change of settings until you actually relaunch it. You can do that from Finder itself, or, since you're already in Terminal, you can do it from there by using the following command:

$ killall Finder

where "man killall" gives you:

KILLALL(1)                BSD General Commands Manual               KILLALL(1)

    killall -- kill processes by name

$ killall Finder

will actually kill and restart Finder.

To do the un-hidding and killalling in one fell swoop just tell Terminal that the two commands should be followed in order:

$ defaults write AppleShowAllFiles TRUE; killall Finder

And the same for hidding them again when you're done with Time Machine:

$ defaults write AppleShowAllFiles FALSE; killall Finder

Knowing about the command line is a must

Knowing about the command line and Terminal in a must. You can't pretend that system does not exist and trying to make sense of all that will drastically increase the amount of stuff you can do on your machine. There are plenty of tutorials on the web. One day I'll eventually write one for "us" translators, with commands that are relevant to our work...

Popular posts (last 30 days):