Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

I'm helping someone using time machine. The user deleted some files off there hdd because they where backed up on the time machine. Well now the user wants to restore the files. Here comes the kicker. The user doesn't remember when they deleted the files, the name of the folder, the name of any of the files, or where they were on the computer in the fist place. Mystery files my favorite!

So I would like create a list of all the files that have been delete between every time machine backup. And then look for a large change.

Any ideas? Or better ideas on how to track down the mystery files?

share|improve this question
2  
How does the user expect to recognize the deleted files if you finally find them? – fideli Nov 18 '10 at 21:42
I think you're shooting in the dark here. But good luck. You can try trolling the Backup drive using Terminal and going through each directory (each backup has its own directory named by the date and time it took place). – Randolph West Nov 18 '10 at 21:57
2  
As an aside: Time Machine is NOT an archiving tool. Like: files that have lived less than a week might not be preserved on a Time Machine backup, no matter how often you backup. – Arjan Nov 18 '10 at 22:40
@fideli -- Yeah... I will let you know how that one goes. – NitroxDM Nov 18 '10 at 22:44
I removed my answer that mentioned the following, but doesn't really answer your question now that I've read it again. Just in case it's helpful anyhow: the timedog command line tool, or the TimeTracker GUI, can tell you what has been backed up. (But not what has been deleted from the file system.) – Arjan Nov 18 '10 at 23:01
show 1 more comment

1 Answer

up vote 2 down vote accepted

Doing a du on the time machine folders would show you when a lot of files were deleted.

cd {time machine folder}
du -s *

Just look for a large change in size from the previous backup. Then you'll need to do a compare on the file listing.

find {backup folder1} > index1.txt
find {backup folder2} > index2.txt
diff index1.txt index2.txt

[edit]

Come to think of it, you could just compare the number of files in each backup until you find one with lots more files. I suspect this would be faster then computing the size of each backup set.

find {backup folder} | wc -l

Also, if you wanted a GUI solution try "Get Info" on each folder.

share|improve this answer
Hmmm, not having my disks at hand right now, but curious: does du exclude hard linked directories from the statistics then? – Arjan Nov 18 '10 at 22:46
Oh, you obviously don't want to exclude the hard linked folders, as you want to compare the total sizes (not the sizes of what was new in the backup). Nice idea! – Arjan Nov 18 '10 at 23:03
I ended up doing du -d 1 to get the size of the folders. – NitroxDM Nov 19 '10 at 16:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.