ACSP Data Management and Backups 2 — Questions and Answers
Question 1: How does Time Machine determine which files to back up in each hourly backup?
- It uses FSEvents to track files that have changed since the last backup (Correct answer)
- It compares a full MD5 hash of every file against the previous backup
- It backs up all files modified in the last 24 hours regardless of previous backups
- It scans the entire drive alphabetically and checks modification dates
Correct answer: It uses FSEvents to track files that have changed since the last backup
Time Machine uses the FSEvents framework, which tracks file system changes in real time, to efficiently identify only the files that have changed since the last backup — avoiding a full scan of the drive.
FSEvents (File System Events) is a macOS API that provides notifications of file system changes. Time Machine subscribes to FSEvents to maintain a list of changed files, making each incremental backup fast and efficient. This is why the first Time Machine backup takes a long time (full backup) but subsequent hourly backups are quick. The FSEvents journal is stored in a hidden .fseventsd directory at the volume root. If this database is lost, Time Machine falls back to a full scan.
Question 2: What is the maximum number of Time Machine backup destinations you can configure in macOS Ventura and later?
- Multiple destinations are supported and Time Machine rotates between them (Correct answer)
- Only one destination can be active at a time
- Up to two destinations: one local and one network
- Up to five destinations regardless of type
Correct answer: Multiple destinations are supported and Time Machine rotates between them
macOS Ventura and later support multiple Time Machine backup destinations simultaneously. Time Machine rotates between configured destinations, providing redundancy across multiple drives or network locations.
Starting with macOS Ventura, Time Machine supports multiple backup destinations and automatically rotates between them. This means backups go to Destination A, then Destination B, then back to A, providing geographic redundancy if drives are kept in different locations. Older macOS versions supported multiple destinations but would prompt the user to choose which to use. Time Machine destinations can be external drives (USB, Thunderbolt, Firewire) or network volumes (Time Capsule, NAS with AFP/SMB).
Question 3: When restoring individual files from a Time Machine backup, which method allows you to browse backup snapshots without entering the Time Machine interface?
- Right-clicking a folder in Finder and choosing 'Browse Backups' with Time Machine open
- Using Migration Assistant and selecting specific files
- Mounting the Time Machine backup disk and navigating the Backups.backupdb folder directly (Correct answer)
- Using the tmutil restore command in Terminal
Correct answer: Mounting the Time Machine backup disk and navigating the Backups.backupdb folder directly
Time Machine backup disks contain a 'Backups.backupdb' folder with dated subfolders representing each backup snapshot. You can mount the drive in Finder and navigate this folder structure directly to copy files without using the Time Machine UI.
Time Machine stores backups in /Volumes/[BackupDisk]/Backups.backupdb/[MacName]/[Date-Time]/[Volume]/ with hard links making each snapshot appear complete while only storing changed files. You can mount the backup drive, navigate Backups.backupdb, and copy files directly in Finder. This method is useful when the Mac you're restoring from is different from the backup source, or when the Time Machine interface is unavailable. tmutil in Terminal also provides restoration capabilities including 'tmutil restore'.
Question 4: What is iCloud Drive's 'Optimize Mac Storage' feature and what risk does it introduce?
- It removes local copies of older iCloud files to free disk space, but files are unavailable without internet (Correct answer)
- It compresses all local files to reduce disk usage while keeping them accessible offline
- It automatically deletes duplicate files found in iCloud Drive
- It moves files to external storage while keeping shortcuts locally
Correct answer: It removes local copies of older iCloud files to free disk space, but files are unavailable without internet
Optimize Mac Storage removes local copies of older or less-used iCloud Drive files when disk space is low, keeping only the file stub (cloud icon) locally. Files must be re-downloaded from iCloud when accessed, requiring internet connectivity.
When enabled in System Settings > Apple ID > iCloud > iCloud Drive, macOS may evict local file copies to free disk space when storage is running low. Files show a cloud download icon in Finder instead of their regular icon. Clicking downloads them on-demand. The risk: if iCloud is unavailable, files cannot be accessed. For Time Machine backups, evicted files are NOT backed up locally — only what's physically on disk gets backed up. Users on slow/metered connections or in areas with unreliable internet should be cautious about this feature.
Question 5: Which Apple technology allows APFS volumes to take near-instant snapshots of the entire volume state?
- APFS Snapshots (Correct answer)
- Time Machine Local Snapshots
- APFS Clones
- HFS+ Journal
Correct answer: APFS Snapshots
APFS (Apple File System) natively supports snapshots — point-in-time copies of a volume's state that are created nearly instantly and consume minimal additional space by using copy-on-write technology.
APFS snapshots capture the complete state of a volume at a specific point in time using copy-on-write. When a snapshot is taken, no data is immediately copied — the snapshot just records the current state. As files change, the original data blocks are preserved for the snapshot while new blocks are written for the current state. Time Machine on APFS drives uses snapshots for local backups. Snapshots can be listed with 'tmutil listlocalsnapshots /' and managed with 'tmutil deletelocalsnapshots'. They're also used during macOS updates as a recovery point.
Question 6: What is the recommended approach for backing up a Mac that uses FileVault 2 encryption?
- Time Machine backs up FileVault-encrypted Macs normally; backups are stored unencrypted on the backup drive unless the backup drive is also encrypted (Correct answer)
- FileVault-encrypted Macs cannot use Time Machine and require third-party backup solutions
- Time Machine must be disabled before enabling FileVault on any Mac
- FileVault automatically encrypts Time Machine backups using the same password
Correct answer: Time Machine backs up FileVault-encrypted Macs normally; backups are stored unencrypted on the backup drive unless the backup drive is also encrypted
Time Machine works normally with FileVault-encrypted Macs. The source Mac's disk is encrypted, but by default Time Machine backups are stored unencrypted on the backup destination — unless you also enable encryption for the Time Machine backup itself.
When setting up Time Machine with a FileVault-enabled Mac, you can optionally encrypt the Time Machine backup by checking 'Encrypt backups' during Time Machine setup. If not encrypted, anyone with physical access to the backup drive can read the backed-up files even though the source Mac is encrypted. For corporate environments or sensitive data, encrypting Time Machine backups is strongly recommended. The encryption password for the backup is separate from the Mac login password and must be stored safely — losing it means losing access to the backup.
ACSP Data Management and Backups 2
How does Time Machine determine which files to back up in each hourly backup?