3

As I understand it, Time Machine creates hard links for all the previous files in a backup, so each timestamped backup folder appears as a full snapshot of the files at the time of the backup. How can I find out which files are new for a given backup and which files were carried forward from the previous backup?

1

3 Answers 3

1

BackupLoupe is $1, excellent, and does just this.

And yes, it does use hard links. This article (part of a 10.5 review on arstechnica) explains how Time Machine works and is a very interesting read.

1

If Time Machine is actually using hard links, you can use 'ls -l' to display the link count for a file. In theory, new files will have a link count of 1. For example:

  $ touch foo
  $ ls -l foo
  -rw-r--r--  1 lars  staff  0 Dec  4 00:22 foo

The second field is the link count. Let's create a link:

  $ ln foo bar
  $ ls -l foo bar
  -rw-r--r--  2 lars  staff  0 Dec  4 00:22 bar
  -rw-r--r--  2 lars  staff  0 Dec  4 00:22 foo

Note that the link count has increased.

You can use the 'find' command to find all files with a single link:

$ find /path/to/backup -links 1 -print
1
  • That's what I thought, too, but it's not that easy. If a folder has been "carried forward," then there will be a hard link to just the folder. The files in the folder won't have additional links, so if a folder remains unchanged for several backups, the link counts for those files will remain at 1 even though they're actually very old. Dec 4, 2009 at 5:38
0

Compare snapshots

In Lion or greater:

  • use the compare verb of tmutil.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .