Over at Der Flounder there’s a great article on how to manage filesystem snapshots on APFS volumes, using the Time Machine utility in Terminal – tmutil.

Filesystem snapshots on APFS have grown from the capabilities of local backups, that Time Machine would store in a .MobileBackups folder at the top level of the startup disk. Storing local backups in a hidden folder was the only way to get this functionality on HFS+ formatted disks, but now that we have a modern filesystem in use, there’s a better way to do this.

Time Machine can take local backups by taking a filesystem snapshot of the disk – this is a process that runs very quickly and has a minimal impact on the system. After taking a snapshot, any writes to files are performed using a Copy on Write system – where the newly written data is written to a different area of the disk, preserving the old data that was originally in the file. These snapshots can then be used to restore anything from an individual file or folder, right up to the entire disk all in one go.

One use for snapshots could be if you have a Mac for development or testing – what you can do is set it all up exactly as you want it and then use tmutil to take a snapshot of the disk. Then you can do whatever you want to it, including system upgrades and updates, uninstall or uninstall software, create new user accounts, pretty much anything short of formatting the drive. When you’re finished and want to restore it back to a known-good configuration, you can use tmutil to restore the entire drive back to how it was when you took the snapshot.

You can also use mount_apfs with the -s option to mount a snapshot as another drive, whereby you can browse it and restore individual files and folders.

e.g.:

mkdir /tmp/snapshotbackup
tmutil listlocalsnapshots /
(pick a snapshot, e.g. com.apple.TimeMachine.2019-02-23-102421)
mount_apfs -s com.apple.TimeMachine.2019-02-23-102421 / /tmp/snapshotbackup

Have a look at all the other wonderful things you can do with snapshots over in the original article.