This chapter covers Apple's Time Machine backup utility for macOS, a key topic for the CompTIA A+ Core 2 (220-1102) exam, specifically under Objective 1.6 (Given a scenario, configure the appropriate backup methods and schedules). Time Machine is the default backup solution for macOS and is frequently tested in the context of backup types (incremental vs. full), destination options, and recovery procedures. Expect approximately 5-7% of exam questions to touch on macOS backup and recovery, with Time Machine being the most prominent tool. You must understand its mechanics, configuration, and limitations to answer these questions correctly.
Jump to a section
Imagine a professional photographer who takes a full-resolution snapshot of their entire studio every hour. Each snapshot captures every piece of equipment, every photo, and every setting exactly as it exists at that moment. These snapshots are stored in a special archive room. If the photographer accidentally deletes an important photo or ruins a print, they can walk into the archive room, find the snapshot from before the mistake, and pull the exact version of the photo they need — or even reconstruct the entire studio exactly as it was at that time. The archive room automatically discards older snapshots when it runs out of space: hourly snapshots from the past 24 hours, daily snapshots from the past month, and weekly snapshots for everything older. The photographer never has to manually decide which files to back up — the system captures everything, and the restoration process is as simple as browsing a timeline and clicking "Restore." This is exactly how Time Machine works: it creates incremental hourly backups of your entire Mac, keeps them for specific retention periods, and allows you to restore individual files or entire system states from a graphical timeline.
What is Time Machine?
Time Machine is Apple's built-in backup utility for macOS, first introduced in Mac OS X 10.5 Leopard. It provides automatic, incremental backups of the entire system — including applications, documents, system files, and settings — to an external drive, network volume, or Time Capsule (Apple's discontinued backup router). Its defining feature is the ability to restore individual files or entire system states from a graphical timeline interface, making data recovery accessible to non-technical users.
Why Time Machine Exists
Before Time Machine, macOS users had to manually copy files or use third-party backup software, which often required complex scheduling and full backups that consumed large amounts of disk space. Time Machine solved this by automating the backup process and using hard links to create incremental snapshots that appear as full backups without duplicating unchanged files. This design minimizes storage usage while providing point-in-time recovery options.
How Time Machine Works Internally
Time Machine uses a combination of file system events, hard links, and incremental snapshots. Here is the step-by-step mechanism:
File System Events: macOS's kernel maintains a log of file system changes (created, modified, deleted). Time Machine subscribes to this log to know which files have changed since the last backup.
Initial Backup: The first backup is a full backup — it copies every file on the startup volume to the destination. This can take hours depending on data size and connection speed.
Subsequent Backups: After the initial backup, Time Machine performs incremental backups. It only copies files that have changed (based on the file system events log). However, to the user, each backup appears as a complete snapshot because of hard links.
Hard Links: On the backup destination, Time Machine creates a folder for each backup (e.g., Backups.backupdb/MacName/YYYY-MM-DD-HHMMSS). Within that folder, files that have not changed are hard-linked to the original file in the previous backup. Hard links are directory entries that point to the same inode (the same data on disk). Therefore, unchanged files occupy no additional space — only the directory entry is new. Changed files are copied as new inodes.
Local Snapshots: On macOS High Sierra (10.13) and later, Time Machine also creates local snapshots on the startup volume if the backup destination is not available. These snapshots are stored in a hidden APFS volume and allow restoration even without the backup drive. Local snapshots are automatically deleted when disk space is low.
Key Components, Values, Defaults, and Timers
Backup Interval: By default, Time Machine backs up every hour (60 minutes) when the backup destination is connected and the Mac is powered on.
Retention Policy: Time Machine does not keep backups indefinitely. It prunes backups based on age:
Hourly backups for the past 24 hours.
Daily backups for the past month.
Weekly backups for all previous months until the destination is full.
Backup Destination: Can be an external drive (formatted as Mac OS Extended (Journaled) or APFS), a network volume (AFP or SMB), or a Time Capsule. The destination must be at least as large as the data being backed up (Apple recommends 2-3x the size).
Exclusions: Users can exclude specific files, folders, or entire disks from Time Machine via System Settings > General > Time Machine Backup > Options.
Encryption: Time Machine supports encrypted backups (AES-128 with a password). This is recommended for network backups.
Configuration and Verification Commands
Time Machine is configured through the GUI, but advanced users can use the tmutil command-line tool. Key commands:
- Check backup status:
tmutil status- List backups:
tmutil listbackups- Compare two backups:
tmutil compare /path/to/backup1 /path/to/backup2- Delete specific backups:
tmutil delete /path/to/backup- Enable/Disable automatic backups:
sudo tmutil enable
sudo tmutil disable- Set destination:
sudo tmutil setdestination /Volumes/BackupDrive
sudo tmutil setdestination afp://server/shareHow Time Machine Interacts with Related Technologies
APFS: Time Machine uses APFS snapshots for local snapshots on APFS volumes. These are space-efficient and allow fast creation.
FileVault: If FileVault is enabled, Time Machine can back up encrypted volumes. The backup itself can also be encrypted.
iCloud: Time Machine does not back up to iCloud. iCloud Drive syncs files, but it is not a backup solution.
Migration Assistant: Time Machine backups can be used with Migration Assistant to set up a new Mac or restore after a clean install.
Limitations
Time Machine does not create bootable backups. To restore the entire system, you must boot from macOS Recovery and use the "Restore from Time Machine Backup" option.
Network backups over Wi-Fi can be slow. Apple recommends Ethernet for initial backups.
Time Machine does not back up the macOS operating system itself if you want to restore to different hardware — it restores to the same model or compatible hardware.
Exam-Specific Details
The 220-1102 exam may ask about the backup type: Time Machine uses incremental backups after the initial full backup.
Retention periods: hourly for 24 hours, daily for a month, weekly until full.
Destination requirements: must be at least as large as the data being backed up.
Common wrong answer: "Time Machine creates full backups every hour" — it does NOT; only the first is full.
Another trap: "Time Machine can back up to iCloud" — it cannot.
Know that Time Machine can restore individual files or the entire system via macOS Recovery.
Connect Backup Destination
Attach an external drive or connect to a network volume (AFP or SMB). The drive must be formatted as Mac OS Extended (Journaled) or APFS. If using a network volume, ensure it is accessible and supports the required protocols. Time Machine will prompt to use the drive for backups. If the drive is not empty, Time Machine will offer to erase it (recommended) or use it as-is. For exam purposes, remember that the destination must be at least as large as the data being backed up — Apple recommends 2-3 times the size to accommodate multiple backups.
Enable Time Machine
Go to System Settings > General > Time Machine Backup. Click the toggle to enable Time Machine. Select the backup destination from the list. Optionally, click "Options" to exclude certain items (e.g., Downloads folder, system files). You can also enable encryption by checking "Encrypt backups" — this requires a password that will be needed to restore. The system will begin the first backup automatically after a 2-minute delay (configurable via `tmutil`).
Initial Full Backup
Time Machine performs a full copy of all files on the startup volume to the destination. This includes system files, applications, user data, and settings. Depending on the amount of data (typically 100-500 GB), this can take several hours over USB 3.0 or longer over Wi-Fi. The backup appears as a single sparsebundle disk image (on network volumes) or a folder structure (on local drives). The user can continue working during the backup, though performance may be slightly impacted.
Hourly Incremental Backups
After the initial backup, Time Machine runs automatically every hour (default interval). It uses the file system events daemon to identify changed files since the last backup. Only changed files are copied to the destination, but hard links create the appearance of a full snapshot. Each hourly backup is stored in a dated folder (e.g., `2025-03-15-140000`). If the backup destination is not available (e.g., drive disconnected), Time Machine creates local snapshots on the startup volume (APFS only) to preserve recent changes until the destination is reconnected.
Retention and Pruning
Time Machine automatically deletes old backups to free space. The retention policy is: hourly backups are kept for 24 hours, daily backups (the first backup of each day) are kept for one month, and weekly backups (the first backup of each week) are kept until the destination is full. When the destination runs out of space, the oldest backups are deleted first. The user can manually delete backups via `tmutil delete` or by browsing the backup folder. Note: The system never prompts the user to delete backups — it handles pruning automatically.
Restore from Time Machine
To restore individual files, open the folder containing the lost file, click the Time Machine icon in the menu bar, and select "Enter Time Machine." A timeline appears on the right side of the screen. Navigate through dated backups (using the arrows or timeline) to find the desired version. Select the file and click "Restore." For full system restoration, boot into macOS Recovery (Command+R at startup), choose "Restore from Time Machine Backup," select the destination, and choose a backup date. The system will be restored to that exact state.
Enterprise Scenario 1: Small Business with Mac Workstations
A design firm with 20 Mac workstations uses Time Machine to back up each machine to a central network-attached storage (NAS) volume via SMB. Each Mac has a 500 GB SSD, and the NAS has 20 TB of storage. Time Machine is configured to back up hourly. The initial backup for each machine is staggered over a weekend to avoid network congestion. Daily, the NAS receives incremental changes averaging 5-10 GB per machine. The retention policy ensures that hourly backups are kept for 24 hours, daily for a month, and weekly for up to 6 months before the oldest are pruned. The firm also enables encryption to protect client data. A common issue is that if the NAS runs out of space, Time Machine will delete old backups without warning, potentially losing older restore points. The IT admin monitors disk usage and sets a quota per Mac to prevent one user from consuming all space.
Enterprise Scenario 2: Remote Worker with Time Capsule
A remote employee uses an Apple Time Capsule (a combined router and backup drive) for Time Machine backups over Wi-Fi. The Time Capsule has a 3 TB hard drive, and the Mac has a 1 TB SSD. The employee often disconnects from the home network, so Time Machine creates local snapshots during disconnection. When reconnected, the local snapshots are merged into the remote backup. A problem arises when the Time Capsule drive fails — the employee loses all backups. The IT department recommends a second backup destination (e.g., an external USB drive) as a backup-to-disk strategy. For exam purposes, note that Time Capsule was discontinued in 2018, but it is still supported and may appear in legacy scenarios.
Scenario 3: Mac Lab in Education
A school computer lab with 30 iMacs uses Time Machine to back up to a dedicated macOS server running macOS Server's Time Machine service. Each iMac backs up to a separate sparsebundle on the server. The server is configured with a 120-day retention policy. Students frequently delete or modify files, and Time Machine allows quick restoration of individual files without IT intervention. The lab manager uses tmutil compare to verify backup integrity monthly. A common misconfiguration is that the server's Time Machine service must be enabled and the share point must be configured correctly — otherwise, backups fail silently. The exam may test the requirement for AFP or SMB file sharing for network backups.
What the 220-1102 Exam Tests
Objective 1.6 covers backup methods and schedules. For Time Machine, the exam focuses on: - Backup type: Time Machine uses incremental backups after an initial full backup. This is a common question: "Which type of backup does Time Machine perform?" Answer: Incremental. - Retention periods: Hourly for 24 hours, daily for a month, weekly until full. Expect a question like: "How long does Time Machine keep hourly backups?" Answer: 24 hours. - Destination requirements: Must be at least as large as the data being backed up. Apple recommends 2-3 times the size. - Encryption: Time Machine supports encrypted backups. The exam may ask: "What is the encryption standard used by Time Machine?" Answer: AES-128. - Local snapshots: On APFS volumes, Time Machine creates local snapshots when the backup destination is unavailable. This is a newer feature that the exam may test. - Restoration: Time Machine can restore individual files or the entire system via macOS Recovery. It cannot restore the operating system to different hardware.
Common Wrong Answers and Why
"Time Machine performs full backups every hour" — This is incorrect because only the first backup is full; subsequent backups are incremental. Candidates choose this because they see the hourly schedule and assume full backups.
"Time Machine can back up to iCloud" — Incorrect. Time Machine does not support iCloud as a destination. iCloud Drive is a sync service, not a backup solution.
"Time Machine creates bootable backups" — Incorrect. Time Machine backups are not bootable. To restore, you must use macOS Recovery.
"Time Machine keeps all backups indefinitely" — Incorrect. Time Machine automatically prunes old backups based on retention policy.
Specific Numbers and Terms
Backup interval: 60 minutes (default)
Retention: hourly (24 hours), daily (1 month), weekly (until full)
Encryption: AES-128
Destination: external drive, network volume (AFP/SMB), Time Capsule
Command: tmutil (for advanced management)
Local snapshots: APFS only, macOS High Sierra (10.13) and later
Edge Cases
If the backup destination is full, Time Machine deletes the oldest backups without warning. The user may lose older restore points.
Time Machine does not back up the macOS operating system if you want to restore to a different Mac model — it is hardware-specific.
Network backups over Wi-Fi may fail if the connection is interrupted. Time Machine will retry on the next scheduled backup.
How to Eliminate Wrong Answers
If a question mentions "full backup every hour," eliminate it — Time Machine uses incremental after initial.
If a question mentions "iCloud" as a backup destination, eliminate — Time Machine does not use iCloud.
If a question says "bootable backup," eliminate — Time Machine is not bootable.
Look for keywords: "hourly," "incremental," "external drive," "Time Capsule," "tmutil."
Time Machine performs incremental backups after an initial full backup.
Default backup interval is every 60 minutes.
Hourly backups are kept for 24 hours; daily for one month; weekly until the destination is full.
Backup destination must be at least as large as the data being backed up (Apple recommends 2-3x).
Time Machine supports encrypted backups using AES-128.
Local snapshots are created on APFS volumes when the backup destination is unavailable (macOS High Sierra and later).
Time Machine cannot back up to iCloud.
Time Machine backups are not bootable; full system restore requires macOS Recovery.
Use the `tmutil` command-line tool for advanced management and scripting.
Time Machine can back up to external drives, network volumes (AFP/SMB), or Time Capsule.
These come up on the exam all the time. Here's how to tell them apart.
Time Machine
Built into macOS, no additional cost.
Creates incremental backups after initial full backup.
Backs up entire system by default.
Retention: hourly for 24h, daily for 1 month, weekly until full.
Restoration via graphical timeline or macOS Recovery.
File History (Windows)
Built into Windows 8/10/11, no additional cost.
Creates incremental backups after initial full backup.
Only backs up files in Libraries, Desktop, Contacts, and Favorites by default.
Retention: user-configurable, default keeps backups until space is needed.
Restoration via File History interface or Windows Recovery Environment.
Mistake
Time Machine creates full backups every hour.
Correct
Only the initial backup is full. Subsequent backups are incremental — only changed files are copied. Hard links make each backup appear full.
Mistake
Time Machine can back up to iCloud.
Correct
Time Machine does not support iCloud as a backup destination. iCloud Drive is for file syncing, not backup.
Mistake
Time Machine backups are bootable.
Correct
Time Machine backups are not bootable. To restore the entire system, you must boot from macOS Recovery and use the 'Restore from Time Machine Backup' option.
Mistake
Time Machine keeps backups forever.
Correct
Time Machine automatically prunes old backups: hourly for 24 hours, daily for a month, weekly until the destination is full.
Mistake
Time Machine only backs up user files, not system files.
Correct
Time Machine backs up the entire system, including system files, applications, and settings. Exclusions can be configured, but by default everything is included.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, Time Machine backs up the entire system, including the operating system, applications, user data, and settings. However, if you restore to a different Mac model, the OS may not be compatible. For full system restore, you must use macOS Recovery and choose 'Restore from Time Machine Backup.' The backup includes everything needed to recreate your system state at the time of the backup.
Yes, Time Machine supports network backups to AFP (Apple Filing Protocol) or SMB (Server Message Block) shares. You can configure this by selecting the network volume in System Settings > General > Time Machine Backup > Add Backup Disk. Network backups are slower than local drives, especially over Wi-Fi. For exam purposes, remember that Time Machine can use both local and network destinations.
Open the folder that contained the file (e.g., Documents). Click the Time Machine icon in the menu bar and select 'Enter Time Machine.' A timeline appears on the right. Use the arrows or click on a date/time to browse backups. Select the file you want and click 'Restore.' The file is copied to its original location. If the file still exists, you will be prompted to keep both or replace.
Time Machine automatically deletes the oldest backups to free up space. It starts with the oldest hourly backups, then daily, then weekly. This process is automatic and does not require user intervention. To prevent data loss, Apple recommends using a drive that is 2-3 times the size of your data. You can also manually delete backups using `tmutil delete`.
Yes, you can exclude specific files, folders, or entire volumes from Time Machine. Go to System Settings > General > Time Machine Backup > Options. Click the '+' button to add items to the exclusion list. Common exclusions include the Downloads folder, virtual machine files, or large media libraries. Excluded items are not backed up and will not appear in the restore timeline.
A local snapshot is a point-in-time copy of your startup volume stored on the same drive (APFS only). It is created when the Time Machine backup destination is not available (e.g., external drive disconnected). Local snapshots allow you to restore files from recent backups even without the backup drive. They are automatically deleted when disk space is low. This feature was introduced in macOS High Sierra (10.13).
When setting up Time Machine, you can check the 'Encrypt backups' option. You will be prompted to create a password (at least 8 characters). This password is required to restore from the backup. Encryption uses AES-128. If you forget the password, the backup is unrecoverable. You can also enable encryption later by selecting the backup disk in System Settings and clicking 'Encrypt.'
You've just covered macOS Time Machine Backup — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?