Using the Finder to Access FileVault Backups on a Time Machine Drive

The Finder Can Restore Time Machine Files, Even FileVault-Protected Ones

Time Machine uses a compelling interface to restore files and folders. But what happens when the file you want to restore is located within a backed-up FileVault image?

The answer is that individual files and folders in an encrypted FileVault image are locked away and cannot be accessed using Time Machine. But Apple provides another application that can access individual FileVault data; it's called the Finder.

Now, this isn't some backdoor that allows just anyone to access encrypted files; you still need to know the user account password to gain access to the files. But it does provide a way to restore a single file or group of files, without having to perform a complete restore from the Time Machine backup.

The not-so-secret part of this tip is that Time Machine simply copies the encrypted sparse bundle image that is your FileVault home folder. So, by using the Finder, you can browse to the backed-up copy, double-click the encrypted image, supply the password, and the image will mount. You can then find the file you want, and drag it to the desktop or another location.

Using the Finder to Access FileVault Backups

  1. Open a Finder window on the drive used for Time Machine backups.​
  2. Double-click the Backups.backupdb folder.​
  3. Double-click the folder with the name of your computer.

    Within the folder you just opened, you will see a list of folders with dates and times.​

  1. Double-click the folder that corresponds to the backup date for the file you wish to restore.

  2. You will now be presented with another folder named after your computer. Within this folder is a representation of your entire Mac at the time the backup was taken.​

  3. Use the Finder to browse to your user account home folder, usually along this path:
    ComputerName/User/username/

    Within the above folder, you'll find a file named username.sparsebundle. This is the copy of your FileVault protected user account.​

  1. Double-click the username.sparsebundle file.
  2. Supply the user account password to mount and decrypt the image file.
  3. You can now use the browser to navigate the FileVault image as if it were any other folder on your Mac. Locate the files or folders you wish to restore and drag them to the desktop or other desired location.
  4. When you've finished copying the files you want, be sure to log out or unmount the username.sparsebundle image.