How to Recover Specific Files From Time Machine on Mac

You don’t always need to restore your entire Mac from Time Machine. Most of the time, you just want a specific file back — the version of a document from before you made bad edits, a photo you accidentally deleted, an app preference you broke.

Time Machine has two interfaces for this: the well-known timeline view, and the command line. Each has its place. Here’s how to use both effectively.

The timeline interface

This is the classic Time Machine experience, redesigned in macOS Sonoma to be cleaner than the old space-themed window.

To access it:

1. Plug in your Time Machine drive
2. Open Finder and navigate to the folder where the file used to be
3. Click the Time Machine icon in the menu bar
4. Select Browse Time Machine Backups

The Time Machine interface opens. The current folder fills the window. The timeline on the right side shows the dates of available backups. Click a date to jump to that snapshot.

Once you find the right version of the folder:

• Select the file (or files, with Shift or Cmd-click)
• Click Restore at the bottom

The file restores to its original location on the live Mac. If you want to restore to a different location instead, hold Option while clicking Restore — that gives you a dialog to choose where.

If the file no longer exists in the live folder, Time Machine restores it to the original path. If a folder structure no longer exists, Time Machine creates the necessary folders.

When the file’s location has changed

Sometimes the folder structure on your Mac is different now than when the backup happened. Time Machine handles this fine in most cases — it remembers the original path and recreates folders as needed.

But if you’ve reorganized significantly, you might want to put the restored file somewhere new. Two options:

1. Hold Option while clicking Restore — choose a custom destination
2. Drag the file from the Time Machine window — drops it wherever you drag it to in the live Finder

The second method is convenient but easy to mess up. If you accidentally drop into a Time Machine snapshot view rather than your live Finder, the file goes nowhere visible. Stick with the explicit Restore button if in doubt.

Restoring older versions of a still-existing file

Maybe the file still exists but you want a previous version. Open Time Machine, navigate to the file’s current location, then scroll the timeline backward.

In the timeline view, you’ll see the file at each backup point. Each one is a separate version. Pick the one you want, click Restore.

By default, Time Machine asks whether to Replace the current file, Keep Both (renames the restored version), or Cancel. Keep Both is usually safer if you’re not 100% sure which version you want. You end up with both files and can compare.

For documents, “Keep Both” lets you diff the versions. For photos and videos, you can preview each. For binary files like databases or Photos library bundles, just be cautious — restoring a partial state can corrupt things.

Skip the manual huntSweep clears the system caches, logs, and old installers a backup can’t reach. Download Sweep free →

The command line: tmutil restore

For more control, the tmutil command in Terminal is more powerful than the GUI. It lets you restore specific paths, scripted bulk restores, and works without opening the Time Machine interface.

To list backups:

tmutil listbackups

You’ll see paths like /Volumes/Backups/Backups.backupdb/MyMac/2026-04-25-093021.

To restore a specific file from a specific backup:

tmutil restore /Volumes/Backups/Backups.backupdb/MyMac/2026-04-25-093021/Macintosh\ HD/Users/me/Documents/Important.pdf ~/Documents/Important.pdf

The pattern is tmutil restore <source> <destination>. The source is the file inside the backup; the destination is where you want it on your live Mac.

For folders:

tmutil restore /Volumes/Backups/Backups.backupdb/MyMac/2026-04-25-093021/Macintosh\ HD/Users/me/Projects/SomeProject ~/Projects/SomeProject

The destination shouldn’t already exist for folder restores, or tmutil will refuse to overwrite. Either delete the existing folder first or restore to a different location.

Restoring from a network Time Machine backup

If your Time Machine backup is on a NAS or Time Capsule, the path looks different. Mount the share first:

1. In Finder, hit Cmd+K (Connect to Server)
2. Enter the server (smb://nas.local/timemachine or similar)
3. Authenticate

Then find the .sparsebundle file. Double-click it to mount it as a volume. Inside, you’ll see the same Backups.backupdb structure as a local drive.

Browse via Time Machine’s GUI by pointing at the mounted volume, or use tmutil restore with the mounted path.

Network restores are slower than local — expect 5-20 MB/s rather than 100+ MB/s on a wired SSD. For a single file, no big deal. For folders with thousands of files, plan for time.

When the file isn’t in any backup

Sometimes the timeline doesn’t show the file at the date you expect. Possible causes:

1. The file was excluded from Time Machine. Check System Settings → General → Time Machine → Options for exclusions. Excluded paths are never backed up.
2. The file was created and deleted between hourly backups. Time Machine snapshots are hourly; a file that lived for less than an hour might never have been backed up.
3. Your backup chain has been thinned past the date. Time Machine deletes old daily backups when space runs low. Check tmutil listbackups | head -10 to see your oldest backup.
4. The file existed only in iCloud. Local files in iCloud Drive are backed up; but if “Optimize Mac Storage” was on and the file wasn’t downloaded locally at backup time, only the placeholder was backed up.
5. The file was on an external drive. External drives aren’t backed up by default unless you specifically include them.

If you can confirm the file should be there but isn’t, your backup might be corrupt. Run tmutil verifychecksums against the backup destination. Errors mean the backup chain has issues.

Restoring deleted files specifically

If you know the file was deleted, the recovery flow is the same — but you need to navigate to the folder where it used to live, then scroll the timeline back to before the deletion.

Tip: if you don’t remember exactly where the file was, search Time Machine. Open a Time Machine backup snapshot, hit Cmd+F in Finder, and search for the filename. Time Machine search works across the snapshot, so you’ll find the file even if you don’t remember the path.

Recovering an entire folder structure

For larger restores — say, an entire Documents folder you accidentally trashed:

tmutil restore /Volumes/Backups/Backups.backupdb/MyMac/2026-04-20-093021/Macintosh\ HD/Users/me/Documents ~/Documents-restored

Note the destination is ~/Documents-restored, not ~/Documents. This is intentional — restoring on top of an existing folder fails by default. Restore to a new path, then merge manually if needed.

For huge restores (10+ GB), the process can take an hour or more. Don’t interrupt it.

Reclaim local snapshot spaceSweep finds APFS local snapshots Time Machine left behind. Get Sweep free →

What about local APFS snapshots?

Local snapshots are a separate set of restore points stored on your boot drive itself, kept for 24 hours. You can browse them through Time Machine’s interface even when no backup drive is connected.

To check what’s available:

tmutil listlocalsnapshots /

Local snapshots are useful for very recent deletions — files you deleted in the last 24 hours. They’re handled by the same Time Machine interface, but the timeline only shows snapshots, not full backups.

To mount a snapshot manually for command-line access:

mkdir /tmp/snapshot
sudo mount_apfs -s "com.apple.TimeMachine.2026-04-28-093000.local" / /tmp/snapshot

Then browse /tmp/snapshot for the files you want, and copy them out. Unmount when done:

sudo umount /tmp/snapshot

This is rough but works without needing your Time Machine drive. Useful if you’re traveling and something got deleted but your backup drive is at home.

Restoring app preferences and settings

App preferences live in ~/Library/Preferences (mostly .plist files). Time Machine backs these up by default, so you can restore individual app preferences without touching everything else:

tmutil restore /Volumes/Backups/Backups.backupdb/MyMac/2026-04-25-093021/Macintosh\ HD/Users/me/Library/Preferences/com.appname.plist ~/Library/Preferences/

After restoring a preference file, quit and relaunch the app. macOS caches preferences in memory, so you might need to log out and log back in for the change to take effect.

For app data and state, look in ~/Library/Application Support/[app] and ~/Library/Containers/[app-bundle-id]. The same tmutil restore pattern works.

Be cautious restoring system-level preferences (/Library/Preferences/). Mixing old and new preferences across macOS versions can cause weird behavior. Stick to user preferences for safety.

Verifying a restored file

After a restore, especially of important files, verify integrity:

• Documents — open them and check the content matches what you expected
• Photos and videos — preview them; corrupt files won’t render
• Code or text — diff against the original if you have it: diff old.txt new.txt
• Binary files — checksums help: shasum -a 256 file.bin

Time Machine restores are usually exact, but corruption can happen — especially on backups from a drive with read errors, or restores interrupted partway through.

If something looks wrong, restore from an earlier backup. Recent backups might inherit corruption from the source if it was already there.

A clean source means cleaner restores

Time Machine backs up whatever’s on your Mac at the time of each snapshot. If your Mac has 60 GB of cache cruft, that’s in every backup. Restoring “everything” means restoring the cruft too.

Sweep handles the boot-drive cleanup that Time Machine doesn’t manage. Caches, old installers, app leftovers, localizations, snapshots past their useful window — none of that needs to be in a restore.

A leaner Mac means:

• Faster Time Machine backups (less to copy)
• Smaller backup destination requirements
• Cleaner restores (no need to re-clean after a full restore)
• More room on the boot drive for the files you actually care about

Time Machine is the version-history safety net. Sweep keeps the source clean so the safety net isn’t preserving 60 GB of files you’d never want restored anyway.

A working file recovery routine

For most people, file recovery happens once or twice a year. Knowing the steps in advance saves the panic when it does:

1. Plug in Time Machine drive
2. Navigate to where the file used to live
3. Open Time Machine from menu bar → Browse Time Machine Backups
4. Scroll timeline back to before the deletion
5. Find file, click Restore
6. Verify the restored file works as expected

That’s a 5-minute task once you’ve done it once. The first time, it’ll feel slow because you’re learning the interface. After that, it’s muscle memory.

The file you can recover in 5 minutes is the file that doesn’t ruin your week. The work to set up Time Machine right (good drive, regular backups, exclusion list) pays for itself the first time you need it.