As I understand it, Time Machine creates hard links for all the previous files in a backup, so each timestamped backup folder appears as a full snapshot of the files at the time of the backup. How can I find out which files are new for a given backup and which files were carried forward from the previous backup?
BackupLoupe is $1, excellent, and does just this.
And yes, it does use hard links. This article (part of a 10.5 review on arstechnica) explains how Time Machine works and is a very interesting read.
If Time Machine is actually using hard links, you can use 'ls -l' to display the link count for a file. In theory, new files will have a link count of 1. For example:
The second field is the link count. Let's create a link:
Note that the link count has increased.
You can use the 'find' command to find all files with a single link: