Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As I understand it, Time Machine creates hard links for all the previous files in a backup, so each timestamped backup folder appears as a full snapshot of the files at the time of the backup. How can I find out which files are new for a given backup and which files were carried forward from the previous backup?

share|improve this question
See also the notes on timedog (command line) and TimeTracker (GUI) at Verifying Time Machine backups. – Arjan Apr 30 '10 at 6:25
up vote 1 down vote accepted

BackupLoupe is $1, excellent, and does just this.

And yes, it does use hard links. This article (part of a 10.5 review on arstechnica) explains how Time Machine works and is a very interesting read.

share|improve this answer

If Time Machine is actually using hard links, you can use 'ls -l' to display the link count for a file. In theory, new files will have a link count of 1. For example:

  $ touch foo
  $ ls -l foo
  -rw-r--r--  1 lars  staff  0 Dec  4 00:22 foo

The second field is the link count. Let's create a link:

  $ ln foo bar
  $ ls -l foo bar
  -rw-r--r--  2 lars  staff  0 Dec  4 00:22 bar
  -rw-r--r--  2 lars  staff  0 Dec  4 00:22 foo

Note that the link count has increased.

You can use the 'find' command to find all files with a single link:

$ find /path/to/backup -links 1 -print
share|improve this answer
That's what I thought, too, but it's not that easy. If a folder has been "carried forward," then there will be a hard link to just the folder. The files in the folder won't have additional links, so if a folder remains unchanged for several backups, the link counts for those files will remain at 1 even though they're actually very old. – Rob Kennedy Dec 4 '09 at 5:38

Compare snapshots

In Lion or greater:

  • use the compare verb of tmutil.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.