The “operation not permitted” error is because the app you’re using for the CLI (Terminal?) does not have Full Disk Access permissions, so it is limited in what parts of the file system it can access. If you grant it permission (System Settings → Security & Privacy → Privacy → Full Disk Access), you should be able to view what you need:
My system has a
> ls -l /Volumes/Time\ Machine
drwxr-xr-x@ 6 root wheel 204 Nov 2 2020 Backups.backupdb
-rwxr-xr-x@ 1 root wheel 107524 Sep 1 2020 tmbootpicker.efi
I suspect your Time Machine volume is formatted APFS (mine is formatted HFS+). Time Machine on APFS (TMA) was introduced in Big Sur and is implemented differently from Time Machine on HFS+ (TMH).
If you create a new Time Machine volume using Big Sur, it is (I believe) created as TMA, and the system will convert the volume if it was previously HFS+. A TMH volume (created using an earlier version of macOS), will remain as TMH after upgrading the Mac to Big Sur.
TMH maintains multiple directory trees of files (one for each backup) that share storage through a complex set of hard-links in the file system. The directory structure looks like:
- At the root level, there is a
Backups.backupdb directory representing the entire backup database.
- Within the backup database a directory for the computer that owns the backups. If your volume is only used with only one computer, then you will only see one such directory. If multiple computers back up to the volume (e.g. if its a Time Machine server for a network), then each computer will have a separate directory here.
- Within a computer’s directory is a set of date-stamped directories, one for each backup. There is also a symbolic link named
Latest that points to the most recent one
- Within each backup, there is a directory for each backed-up volume. On my Big Sur system, I see three volumes - the system volume, its Data volume and the Recovery volume. It appears that the System and Recovery volumes are leftovers from Catalina - they have not updated since I upgraded macOS to Big Sur.
- Within each volume’s directory are the actual backed-up files. Files and directories that have not changed since the previous backup are hard-links to the same files/directories, in order to avoid wasting space on the device.
TMA, on the other hand, is based on APFS’s snapshot mechanism. It uses a very different directory structure, that looks like:
At the root level, there is a set of virtual disk volumes, each one corresponding to a single APFS snapshot. These are presented in the Finder based on (presumably) the contents of a root-level hidden file,
backup_manifest.plist that tracks everything, so the Finder doesn’t need to mount all of the snapshots in order to present them
You won’t see the snapshots from the command-line unless you explicitly mount them (e.g. using the
diskutil command or a GUI tools that support snapshots, like CCC)
If you don’t mount any backup snapshots, it appears (again, from the article I’ve read) that command-line apps will only see the most recent snapshot at the root level of the volume. A folder with a name consisting of a timestamp and a
.previous suffix. It will contain the contents of that specific snapshot (which I assume will be the most recent one).
Within each snapshot (as presented by the Finder) is a folder for each backed-up disk volume.
If you manually mount a snapshot, it will contain a single time-stamped directory (representing the backup). This will in-turn contain a folder for each backed-up volume.
Within each volume’s folder are the backed-up files. The snapshot mechanism is used to ensure that unchanged files share disk blocks across multiple backups.
You can’t erase individual files from TMA backups (so the old article @ace wrote is now only applicable to TMH backups), because snapshots are read-only, but the Finder interface will let you delete whole backups (including the associated snapshots).
It appears that TMA does not back up the System volume. So a system-restore from Time Machine will require first installing macOS (e.g. via Internet Recovery) and then restoring the Data volume from TM.
See also: Time Machine to APFS: Backup structure and access – The Eclectic Light Company