Use Finder to Access FileVault Backups on a Time Machine

Time Machine on a Mac makes regular backups to an external drive

Apple's Time Machine uses a convenient interface to restore backed-up files and folders on a Mac, but what happens when the file you want to restore is located inside a backed-up FileVault image?

The information here was verified in macOS version 10.15 (Catalina) but generally applies to other versions of macOS as well.

About FileVault

FileVault is a disk-encryption program on Mac computers. With it, you can encrypt folders and protect them with a password.

Individual files and folders in an encrypted FileVault image are locked away and cannot be accessed using Time Machine. However, Apple provides another application that can access FileVault data: the Finder. This isn't a backdoor that allows just anyone to access encrypted files. You still need to know the user account password to gain access to the files, but it provides a way to restore a single file or group of files without having to perform a complete restore from the Time Machine backup.

The not-so-secret part of this tip is that the Time Machine copies only the encrypted sparse bundle image that is your FileVault home folder. By using the Finder, you can browse to the backed-up folder, double-click the encrypted image, supply the password, and the image will mount. You can then find the file you want, and drag it to the desktop or another location.

Using the Finder to Access FileVault Backups

Here's how to open a FileVault Backup:

  1. Open a Finder window on the Mac by clicking the Finder icon on the dock or by using the keyboard shortcut Command + N.

  2. Click the drive you use for Time Machine backups in the left panel of the Finder window.

    Locations in the Finder
  3. Open the Backups.backupdb folder and then the folder that has the name of your computer. Within the latter is a list of folders with dates and times.

    The backups folder on a backup drive
  4. Open the folder that corresponds to the backup date for the file you want to restore.

  5. You are presented with another folder named after your computer. Open this. Within this folder is a representation of your entire Mac at the time the backup was taken.

  6. Use the Finder to browse to your user account home folder, usually along this path: ComputerName > Users > username. Inside is a file named username.sparsebundle. This is the copy of your FileVault-protected user account.

  7. Double-click the username.sparsebundle file.

  8. Supply the user account password to mount and decrypt the image file.

  9. Use the browser to navigate the FileVault image as if it were any other folder on your Mac. Locate the files or folders you want to restore, and drag them to the desktop or another location.

When you've finished copying the files you want, be sure to log out or unmount the username.sparsebundle image.

Was this page helpful?