Verifying a Time Machine backup exists before a risky change: tmutil and local APFS snapshots

Goal

Confirm a Time Machine backup — or, failing that, a recent local APFS snapshot — actually exists and is current before making a risky change: a major OS upgrade, a disk repartition, a bulk deletion script.

Prerequisites

Terminal; sudo for some tmutil subcommands.

Steps

1. Confirm a backup destination is configured at all: tmutil destinationinfo. An empty or error result means there is no Time Machine destination — do not assume one exists just because the feature is enabled somewhere.
2. List completed backups and their timestamps for that destination: tmutil listbackups; the newest entry's timestamp is the actual recovery point, not "now." If this fails with a permissions error, the calling terminal lacks Full Disk Access (see the TCC article in this series) — that is not proof that no backup exists.
3. If the newest backup is older than acceptable for the change about to be made, trigger one and wait for it: tmutil startbackup --block, which does not return control until the backup finishes or fails.
4. Check on a backup already in progress from another trigger: tmutil status.
5. Independently of Time Machine, list local APFS snapshots on the startup volume, which macOS creates automatically for its own purposes: diskutil apfs listSnapshots /.
6. Treat a local snapshot as a convenience only: it lives on the same physical disk, so it does not survive drive failure or loss and does not substitute for steps 1–3 before a destructive operation.

Expected result

tmutil destinationinfo names a destination, tmutil listbackups shows an entry from within the acceptable window, and tmutil status — if a backup was just started — eventually reports Running = 0 with no error; only then proceed with the risky change.

Limits and test basis

tmutil and diskutil subcommand syntax comes from a command reference, since Apple does not publish these tools' flags as a web page. tmutil startbackup --block still depends on the destination being reachable — a mounted network share or a connected disk — so a script that calls it without first checking destinationinfo can block or fail for a reason unrelated to the backup itself.