Skip to main content

iOS APFS Snapshots

Have you ever noticed your iOS device's storage slowly filling up, even though no large files appear when scanning the filesystem? For example, if you're repeatedly running MATRIX tests on an iOS device, you may see available storage gradually dwindle over time. The culprit may not be files you can see at all, it's likely due to the hidden impact of an APFS snapshot.

What is an APFS Snapshot?​

APFS snapshots are complete, read-only, mountable representations of a volume at a specific point in time. They include the file system metadata, the full set of data extents required to restore the state of the filesystem, and a copy of the volume's superblock as it existed when the snapshot was created.

How It Impacts Device Free Space​

An APFS snapshot begins to consume space only when data that existed at the time of the snapshot is modified or deleted. Because snapshots are immutable, APFS cannot reuse the original blocks, they must be preserved exactly as they were.

When the live filesystem makes changes, APFS writes the updated data to new blocks instead of overwriting the originals. This behavior, known as copy-on-write, ensures the snapshot remains a consistent, point-in-time view of the filesystem.

The more the live filesystem changes, the more old data from the past accumulates and increases disk usage, even though the snapshot itself remains unchanged.

Removing an APFS snapshot​

On a jailbroken device, removing the APFS snapshot is relatively straightforward:

  1. Optionally capture the current disk usage to see how much space is freed by removing the snapshot.

    df -h

  2. Run snappy -f / -l on the device to list the APFS snapshot. You should see something like com.apple.os.update-hash returned.

    On a modern device, running 18.3.2, the snapshot looks like:

    root# snappy -f / -l
    Will list snapshots on / fs
    com.apple.os.update-1866D4687EC56341BCF48B348E09341F0CD16AA41512D1D82D61E037BBC9E902+restored_default_unsealed

    On an older device, running 15.0, the snapshot looks like:

    root# snappy -f / -l
    Will list snapshots on / fs
    com.apple.os.update-BA871205A0F49BEA1FED2DF85A6BD8B98A5163EB

  3. Remove the snapshot, referencing the full value returned from listing the APFS snapshot: 

    snappy -f / -d com.apple.os.update-hash

  4. Flush out any pending writes before rebooting device:

    sync && sleep 2 && sync

  5. Reboot the device. Doing a df -h after the reboot should show space has been freed.