As I understand it, Time Machine creates hard links for all the previous files in a backup, so each timestamped backup folder appears as a full snapshot of the files at the time of the backup. How can I find out which files are new for a given backup and which files were carried forward from the previous backup?
3 Answers
BackupLoupe is $1, excellent, and does just this.
And yes, it does use hard links. This article (part of a 10.5 review on arstechnica) explains how Time Machine works and is a very interesting read.
If Time Machine is actually using hard links, you can use 'ls -l' to display the link count for a file. In theory, new files will have a link count of 1. For example:
$ touch foo
$ ls -l foo
-rw-r--r-- 1 lars staff 0 Dec 4 00:22 foo
The second field is the link count. Let's create a link:
$ ln foo bar
$ ls -l foo bar
-rw-r--r-- 2 lars staff 0 Dec 4 00:22 bar
-rw-r--r-- 2 lars staff 0 Dec 4 00:22 foo
Note that the link count has increased.
You can use the 'find' command to find all files with a single link:
$ find /path/to/backup -links 1 -print
-
That's what I thought, too, but it's not that easy. If a folder has been "carried forward," then there will be a hard link to just the folder. The files in the folder won't have additional links, so if a folder remains unchanged for several backups, the link counts for those files will remain at 1 even though they're actually very old. Dec 4, 2009 at 5:38
timedog
(command line) and TimeTracker (GUI) at Verifying Time Machine backups.