PcFixin'

Mac System Restore: Roll Back With Time Machine

By PcFixin' · July 17, 2026 · Mac · Mac, macOS, Time Machine

Set up Time Machine and recover your files, apps, and settings after malware, accidental changes, or other Mac trouble.

Does a Mac have System Restore?

macOS does not have Windows-style restore points. Its closest built-in equivalent is Time Machine, which regularly saves copies of your files, apps, user accounts, and many settings to an external drive or supported network storage.

Time Machine can recover an older version of one file or restore your information after macOS has been reinstalled. It does not normally roll the operating system itself back to an earlier version, so it cannot simply undo a major macOS upgrade.

These instructions use macOS Tahoe 26. The names and locations are nearly identical in macOS Ventura 13, Sonoma 14, and Sequoia 15, all of which use System Settings.

Turn on Time Machine

Connect an external drive with enough room for your Mac's data. A drive with at least twice the storage currently in use gives Time Machine more space for older versions. The drive may need to be erased during setup, so copy anything important from it first.

Leave the drive connected whenever practical. Time Machine automatically makes hourly backups and removes the oldest versions when space runs low. A Mac laptop can also create temporary local snapshots between visits to the backup drive, but those snapshots are not a replacement for a separate backup.

1. Open the Apple menu and choose System Settings.
2. Select General in the sidebar, then click Time Machine.
3. Click Add Backup Disk and select your external drive.
4. Click Set Up Disk. Turn on backup encryption if offered, then create a password you will not lose.
5. Allow the first backup to finish. It may take several hours, but you can continue using the Mac.

Restore a file or folder

Use this method if a document was deleted, damaged, encrypted, or changed by mistake. Before restoring, open the Finder folder where the item normally belongs. For example, open Documents if you need an older document.

Time Machine shows dated versions of that folder. Restoring an item copies the selected version back to its original location. If another file has the same name, macOS may ask whether you want to keep the original, keep the restored copy, or keep both.

1. Connect the Time Machine backup drive.
2. Open Time Machine using Spotlight, or choose Browse Time Machine Backups from the Time Machine menu-bar icon.
3. Use the timeline or arrows to move to a date before the file was lost or changed.
4. Select the file or folder, then click Restore.

Recover the Mac after malware or a serious problem

If unwanted software changed only a few files, remove the suspicious app, update macOS, run a trusted security scan, and restore clean copies of affected documents. Avoid opening installers or applications recovered from around the time the trouble began.

For widespread malware or severe system damage, the safest approach is usually to erase the Mac, reinstall macOS, and transfer information from a Time Machine backup made before the problem started. This deletes everything, so confirm that the backup opens and contains your important files first.

On Apple silicon Macs, shut down, then hold the power button until startup options appear. Choose Options and Continue. On an Intel Mac, restart while holding Command-R. In macOS Recovery, Disk Utility can erase the startup volume; depending on the Mac, the button may say Erase or Erase Volume Group. Quit Disk Utility afterward and choose Reinstall macOS.

During setup, choose the option to transfer information from a Mac, Time Machine backup, or startup disk. Select the backup drive and a backup dated before the incident. To reduce the chance of bringing malware back, consider transferring your user account and documents while reinstalling applications from trusted sources.

1. Disconnect the Mac from the internet if malware is actively changing files or sending pop-ups.
2. Verify that a Time Machine backup from before the incident is available.
3. Start in macOS Recovery and erase the startup volume only after confirming your backup.
4. Reinstall macOS, reconnect the backup drive, and transfer data from the known-good backup.
5. Install all macOS updates and download applications again from the App Store or their official developers.

What Time Machine cannot undo

Time Machine is excellent for recovering personal data, but it is not an exact Mac version of System Restore. Restoring a backup through Migration Assistant does not normally downgrade the installed version of macOS. If a system update is causing trouble, first install any newer bug-fix update, check the app developer's support information, or contact Apple Support.

A backup can also contain malware if it was created after the infection. Keep more than one backup when possible, and do not erase your only known-good copy until the Mac is working normally again.

Bottom line

Time Machine is the Mac's practical alternative to System Restore: set it up before trouble starts, then use it to retrieve older files or rebuild a clean Mac from a known-good backup. It cannot roll macOS itself back with one click, but it can protect the data that matters most.