Australian cloud for business software — built and run in Sydney since 2003

+61 2 8282 5656
support@netleverage.com
Talk to an engineer
Talk to an engineer
NetLeverage
NetLeverage

Backing up business Macs with Time Machine: what it keeps, what it skips and what a restore needs

Technical article
Backup & Recovery

Originally published:

About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.

In many small offices the Mac backup plan is a USB drive plugged into each laptop, set up once with Time Machine and rarely looked at again. Time Machine is a capable tool, and Apple documents it in detail. The trouble is that a business needs answers the setup screen does not ask: how far back can we go, which copy survives a burglary, who holds the encryption password, and how long will it take to get a person working again on a new machine?

This guide sets out what Apple's own documentation says about Time Machine's coverage, retention, local snapshots, destinations, encryption and full-system restore. It then turns those facts into checks a business can run and a restore rehearsal it can do without risking anyone's working Mac.

Why it matters

A Mac is often the only place a staff member's working files live, particularly in design, media and professional services (our reading). When that Mac is lost, stolen or fails, the recovery question is not whether a backup exists but whether the right backup exists, on a disk that is still available, with a password someone can still find.

Time Machine's behaviour shapes those answers in ways that are easy to miss:

  • It thins old backups on a schedule and deletes the oldest when the disk fills.
  • Its local snapshots sit on the same internal disk as the files they protect.
  • A network backup disk's password can expose every user's backups to anyone who knows it.
  • If the operating system needs reinstalling, that comes before migration from the backup; a suitable replacement Mac may already have macOS installed.

What Time Machine backs up, and what it does not

Apple's Mac User Guide says Time Machine can "back up files on your Mac that weren't part of the macOS installation, such as apps, music, photos, and documents." It is equally direct about the other side: "Time Machine doesn't back up system files or apps installed during macOS installation."

A suitable replacement Mac may already have macOS installed. If macOS needs reinstalling, complete that first, then migrate the backed-up data. It does mean the backup is not a disk image; it is a backup of your data and the software you added (our reading).

Apple describes these two sources of exclusions:

  • The exclusion list in Time Machine settings. Apple's troubleshooting page says that if Time Machine does not back up certain files, "you may need to make changes to the list of excluded items".
  • Software that excludes its own data. The same page notes: "In rare cases, Time Machine can't back up software from companies other than Apple due to a setting made by that software." Apple's advice is to contact the manufacturer.

A file not captured in a particular recovery point cannot be restored from that recovery point. Earlier backups may contain a copy made before an exclusion was introduced. Check the relevant backup dates and actual contents before deciding that a file is unavailable. If the original still exists, correct the agreed backup scope and take a new backup through the normal authorised process.

How long backups are kept

Apple's support article states the schedule plainly: "Time Machine automatically makes hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months. The oldest backups are deleted when your backup disk is full."

Two consequences follow (our reading):

  • Retention depends on disk size and rate of change. "All previous months" lasts only until the disk fills. A Mac that handles large video or image files may keep far less history than one that handles documents.
  • Fine-grained history is short. If a file was damaged three weeks ago and nobody noticed, the copy you need is a daily one, not an hourly one. After a month it is a weekly one, and edits made between weekly backups may not exist in any of them.

Apple's sizing advice is to "Use a storage device with at least twice the storage capacity of your Mac." That is a starting point, not a retention promise.

The backup frequency can be changed. In macOS Ventura 13 or later, Apple says to choose a setting from the "Back up frequency" menu under Options. If someone has set this to manual, the Mac is not being backed up on any schedule at all until a person starts each backup (our reading).

Local snapshots are not a second copy

On a Mac with an APFS startup disk, Time Machine also keeps local snapshots. Apple describes them this way: "Time Machine saves one snapshot of your startup disk approximately every hour, and keeps it for 24 hours. It keeps an additional snapshot of your last successful Time Machine backup until space is needed."

These are useful. Apple says that "When your backup disk isn't available, Time Machine automatically uses local snapshots to help you restore files." For a laptop that leaves the office, they cover an accidental deletion on the train.

They are not a backup in the business sense, and Apple does not present them as one. The Mac User Guide says snapshots are "stored on the same disk as the original files", and that "it's recommended that you back up your files to a location other than your internal disk". If the Mac is stolen, fails or is wiped, its local snapshots go with it (our reading). Apple also notes that "Time Machine automatically deletes snapshots as they age or as space is needed for other things".

Where the backups can go

Apple lists the supported destinations: "an AirPort Time Capsule, with a network-attached storage (NAS) device that supports Time Machine over Server Message Block (SMB) or Apple Filing Protocol (AFP), or with an external storage device connected directly to your Mac". Where both are offered, Apple's tip is to "use SMB".

Some points a business should note from the same page:

  • "APFS or APFS Encrypted disks are the preferred format for a Time Machine backup disk."
  • "The entire APFS volume is reserved for Time Machine backups." If the same physical drive is used for other files, Apple says to create a separate APFS volume.
  • "Time Machine can't back up to iPhone, iPad, or iPod or to a disk formatted for Windows." Reformatting a Windows-formatted disk for Time Machine removes its data.
  • "Some network disks from manufacturers other than Apple don't support Time Machine."

One USB drive is one copy in one place. A drive that lives plugged into the laptop is stolen with the laptop, and a drive that lives on the desk beside an office Mac shares its fire, flood or break-in (our reading). Apple's support article links to guidance on backing up to multiple storage devices; a second destination, kept somewhere else, is the usual answer (our recommendation).

Backward compatibility has a floor. Apple warns: "If you create a backup on a Mac running macOS 12 or later, the files can only be restored to a Mac running macOS 11 or later." A business keeping an old Mac as a spare should check that it can read current backups.

Encryption and who can read the backups

Apple's guidance is that "The best way to keep your backups secure is to encrypt your backup disk." The setup steps note that if you turn on Encrypt Backup, "you're asked to create a backup password. You will need it if you later attempt to restore files from the backup."

For a business, that password is a recovery dependency, in the same way as the disk (our reading). If it exists only in the head of the staff member whose laptop was stolen, the backup may be unusable by anyone else. Record it in the organisation's password manager or key register, with access for at least two people (our recommendation).

Converting an existing setup to encrypted backups behaves differently by destination. Apple says that for "a Time Capsule or network backup disk", switching to encrypted means "your existing backups are erased and new encrypted backup sets are created". For a locally connected disk, "your data is preserved and encrypted." Moving a network destination to encryption therefore resets its history (our reading).

Network disks carry a specific risk. Apple warns that "Anyone who knows the password can access any data backed up to the disk, regardless of which user owns the data", and that "If the backup is encrypted, it's safe from users and network administrators that know the network disk password, but don't know the backup encryption password." For unencrypted external disks: "any person who gains possession of that disk can read any data backed up to that disk."

What a full restore actually involves

Restoring a single file is simple: open the folder, open Time Machine, browse back and click Restore. Apple notes that "Restored items return to their original location."

A whole-Mac restore is a longer process, and it is worth knowing before the day you need it.

On a damaged Mac, Apple says: "You must first reinstall macOS on your Mac before you can restore your files using your Time Machine backup." If the startup disk is the problem, "repair or replace the disk before following these instructions." After reinstalling, Migration Assistant offers to transfer from a Time Machine backup, and "You may also have to enter the password you used to encrypt the backup."

On a new or replacement Mac, Migration Assistant "can use that backup to restore all of your personal files, including your apps and everything in your user account." Some details affect how quickly staff are back at work:

  • For an administrator account, you are asked to set a password. For a standard account, "a temporary password is assigned and appears onscreen", and the user enters it on first login before choosing their own.
  • If an account with the same name already exists, you choose between replacing it and renaming the old one.
  • "Large transfers might need hours to complete, and might seem to pause occasionally."
  • After a system restore, "Time Machine may perform a full backup at the next scheduled backup time."

Plan for finding a replacement Mac, any necessary macOS installation, migration and application validation. A subsequent full backup may add load and time after the user is working again; it is not automatically a prerequisite for first login. The exact recovery time needs an isolated rehearsal.

Checking what a Mac is protecting

Use Apple's documented settings and Time Machine interface for the initial inspection. In macOS Ventura 13 or later, inspect System Settings, General, Time Machine and Options. Record the configured destination, backup frequency and listed exclusions without changing them. Menu names and controls vary by macOS version; use the matching version of Apple's guide.

The Time Machine menu shows the date and time of the latest backup. Compare that with the required protection window, then inspect the relevant recovery point for named synthetic test files. A recent timestamp alone does not establish that every business folder was captured.

Check data locations outside the home folder as well as Documents and Desktop. An exclusion list is one input to that check; software-specific exclusions and cloud-only files may require separate vendor guidance. Do not assume that seeing a destination or a local snapshot proves an independent recoverable copy exists.

For backup verification, use the supported method documented for the actual destination and macOS version, then add the isolated restore rehearsal below. This article does not prescribe tmutil syntax from a secondary reference or claim that silent checksum output establishes complete coverage.

Rehearsing a restore safely

Do not rehearse a full restore on a staff member's working Mac. Migration Assistant can replace accounts, and a restore returns items to their original location (our reading of Apple's steps). Use a spare Mac, or a Mac that has been set aside and erased for the purpose, with an authorised test backup.

A rehearsal that proves the important things (our recommendation):

  1. On a test Mac, create a test user account and a folder of synthetic files: a document, a spreadsheet, a large image, and a file in a folder outside the home folder. Record a SHA-256 hash of each using a trusted utility whose instructions have been checked for the test system.
  2. Back up the test Mac to a dedicated test destination with encryption on. Store the backup password where your business stores recovery passwords.
  3. Change one file, delete another, and wait for the next hourly backup. Use Time Machine to restore the deleted file and an earlier version of the changed one. Compare hashes with the originals.
  4. On a second, erased Mac, use Migration Assistant to transfer the test account from the backup. Time each stage: macOS setup, transfer, first login.
  5. Have someone other than the person who set up the backup retrieve the encryption password and complete the restore.
  6. Compare every restored file's hash with the recorded value. A file that is missing points to an exclusion, a backup that never completed, or the wrong backup date. A file that is present but different points to the wrong version or damage. Each needs a different fix.
  7. Write down the time taken and any step that needed knowledge only one person had.

Have a technically qualified person review the steps before adapting any of this to a real staff Mac.

Worked example (illustrative)

The following is invented to show the pattern. A five-person architecture practice backs up each Mac to a USB drive left plugged in. One partner's laptop and its drive are stolen from a car. The local snapshots went with the laptop. The only other copies of the project files are those synchronised to a shared drive, which covers the current versions but not the drawings deleted from it a fortnight earlier.

The practice changes three things. Each Mac now backs up to two destinations: the USB drive, and an encrypted Time Machine share on the office NAS. Backup passwords go into the practice's password manager. And every six months, a staff member who did not set up the backups restores one person's account onto the spare Mac and times it.

Risks and limits

  • This guide relies on Apple's published pages as displayed on 14 November 2026. Steps and menu names differ between macOS versions; Apple's guide has a version selector.
  • Administrative command syntax is intentionally omitted because a primary manual for the stated macOS version was not verified. Use current Apple guidance and the installed manual when preparing a separate technical procedure.
  • Retention depends on disk size and change rate. Apple does not promise any fixed history beyond the schedule it describes.
  • Time Machine's handling of files kept only in cloud storage (such as iCloud Drive with optimised storage, or other synchronisation tools) was not covered by the sources read. Check with the provider whether files that are not stored locally are in the backup.
  • Third-party NAS support for Time Machine varies by manufacturer and firmware.
  • Commands that change configuration (enable, disable, addexclusion, removeexclusion, setdestination, delete and others) are deliberately not given as steps.
  • Time Machine is one tool. Whether it suits a particular business depends on how many Macs it has, where they are, and what else holds its data.

Sources

All accessed 14 November 2026.

Related future topics

  • Backing up Macs in a managed fleet: what device management can and cannot enforce
  • Cloud-synchronised folders and backups: why sync is not a recovery point
  • Keeping backup encryption passwords recoverable when staff leave

This article was originally published on .