Solution for Time Machine ‘error while restoring from the backup’

Last updated: 29 September 2020

I had a nightmare restoring from a Time Capsule backup. Eventually I found a little-documented solution.

In Brief

– I was unable to restore from a Time Machine backup. Error: “An error occurred while restoring from the backup.” I found next to nothing online to solve this problem.

– The error log showed a “[RESTORE] critical failure (error: -5000…” for which there is no support online.

– The problem affected Time Machine backups on both a USB drive and an Apple Time Capsule.

– The solution is to identify the corrupted files in question and quarantine them (before optionally manually restoring them later).

– On Time Capsule backups, this solution is more complicated because of how the backups are saved and how difficult it is to edit them.

The problem

I was trying to restore my machine from a Time Machine backup to a new laptop in recovery mode.

A few hours into the restore (about three-quarters of the way through the data transfer) the restoration would always fail with “An error occurred while restoring from the backup.”

I retried the backup to no avail; I got the same error. On inspecting the log (Window -> Log Window), I saw that there was a “critical failure” that was not being handled gracefully by the Time Machine System Restore app in recovery mode. [Hat tip to drice99 for bringing the installer log to my attention, and Tom Fox for the photo below but one.]

In my case, the file or folder that I later found out was corrupted was a Mac App Store receipt folder for an application called “WiFi Signal”. It later turned out that this app would always (at least on my system) produce a corrupt “_MASReceipt/receipt” folder. My final solution was to completely delete the app and find an alternative so that my fresh Time Machine backups don’t get corrupted from this dodgy folder. But according to various user reports I’ve received via e-mail, this problem affects various apps.

I wasn’t able to take another backup from my old machine. I had to fix the Time Machine backup to restore my system. Editing the Time Machine backup to remove the dodgy folder was difficult.

The solution

(1) Initially I needed a Finder and Terminal window so I had to setup the new Mac as new with no user data (as a complete fresh install) so I could fully access the Time Machine backup to apply the fix. Then I connected the backup to the Mac.

(2) In the case of the Time Capsule I had to first mount the backup:

• In Terminal, I ran these commands:

sudo su -

First we escalate our privileges.

hdiutil attach -readwrite -noverify -noautofsck /Volumes/TimeMachine/<my-backup>.sparsebundle

Then we mount the Time Capsule ‘sparse bundle’ as if it is a disk.


• By now I had the Time Capsule Time Machine backup of my system mounted as if it was a USB drive Time Machine backup. (So you can skip this second step if you’re working with a USB drive and not a Time Capsule.)

(3) Then I had to delete the problematic folder that was identified in the log:

I took a backup of the folder I was deleting and put it on a USB thumb drive.

Then in Terminal, I ran this command:

sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/MacOS/bypass rm -rfv /Volumes/[disk]/Backups.backupdb/[path]

NOTE: Since High Sierra the path of the bypass tool has changed, so use:

sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass rm -rfv /Volumes/[disk]/Backups.backupdb/[path]

This command uses a Time Capsule ‘Safety Net’ feature that lets us ‘bypass’ restrictions and ‘remove’ (rm) the problematic folder.

To make this more easy to follow, he’s a real world example:

sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass rm -rfv /Volumes/Backups/Backups.backupdb/Harry\'s\ Mac/2018-03-01-095034/Macintosh\ HD/Users/harryfear/Library/Application\ Support/WiFi\ Signal/_MASRreceipt

Note that where your path has apostrophes and spaces (such as with Apple computer names like Harry’s Mac), you’ll have to escape those characters by putting a backslash before them as I did above. So, …/John’s iMac/… becomes …/John\’s\ iMac/…


In cases where you receive error “Operation not permitted” on trying the above command in Terminal on MacOS, please try running the same command (without sudo at the beginning) in MacOS Recovery Mode instead and use the Terminal app there.


(4) Then go back into Recovery mode on the Mac and reattempt to restore from the modified backup.

Let me know if it doesn’t work.