Find files that will be backed up by Time Machine

Question

It'd be useful to see what Time Machine will backup before the backup actually occurs. I believe it should be possible to approximate this with mdfind. Is there a standard search query that accomplishes this? Or a way to ask Time Machine directly?

Answer 1

In OS X 10.7 (Lion) you can use tmutil. To compare the current state of the machine with the most recent backup you simply use the command,

tmutil compare

But you'll probably want to redirect the output to a file because there may be a lot of it. You can restrict the comparison to certain types of difference (e.g., file size, file permissions). It does more, but I can't describe the details more succinctly than the tmutil man page itself:

compare [-@esmugtdrvEX] [-D depth] [snapshot_path | path1 path2]
       Perform a backup diff.

       If no arguments are provided, tmutil will compare the computer to
       the latest snapshot. If a snapshot path is provided as the sole
       argument, tmutil will compare the computer to the specified snap-
       shot. If two path arguments are provided, tmutil will compare
       those two items to each other.  tmutil will attempt to inform you
       when you have asked it to do something that doesn't make sense or
       isn't supported.

       The compare verb allows you to specify what properties to com-
       pare. If you specify no property options, it is assumed that you
       want to compare a basic set of metadata. This default property
       set is equivalent to the -smugt option set. Specifying any prop-
       erty option overrides the default set.

       Options:
           -a    compare all suppored metadata
           -@    compare extended attributes
           -e    compare ACLs
           -s    compare sizes
           -m    compare file modes
           -u    compare UIDs
           -g    compare GIDs
           -t    compare modification times
           -d    compare file data forks
           -r    ignore specified root paths and compare descendents
                 instead
           -D    limit traversal depth to depth levels from the begin-
                 ning of iteration
           -E    don't take exclusions into account when comparing items
                 inside volumes
           -v    enable verbose mode (enables reporting of all identical
                 items, which is noisy)
           -X    print output in XML property list format

Answer 2

The other answer mentioning tmutil compare is the canonical way to ask OS X to simulate the next backup event and check which files and/or metadata have changed since the last backup. However, there is a very useful binary called tmdiagnose that I haven't seem mentioned here on SuperUser which is intended for diagnosing issues with Time Machine that will also let you know in excruciating detail the configuration for the next backup, the system exclusion paths, the user exclusion paths as well as what rules were used on all prior backup and snapshot events.

Look inside the hostname -s.tmdiagnostic.zip file for both the configuration.txt as well as the exclusions.plist text files to determine which files and paths are and were excluded.

Answer 3

I have the same question. Since there does not appear to be an exact answer, let me propose this:

1. Allow Time Machine to make the backup.
2. Look inside of it using BackupLoupe to see what was backed up.
3. If you're not happy with it, adjust the exclusions.
4. If you want to delete the snapshot, mount the sparsebundle file by clicking on it, then browse to the snapshot you don't want and remove it.

BackupLoupe

Exclusions

     

Answer 4

Something like this could be used as a starting point

mdfind "kMDItemContentModificationDate >= '\$time.iso($(cat /Private/var/db/.TimeMachine.Results.plist | grep "BACKUP_COMPLETED_DATE" -A1 | grep "<date>" | cut -d">" -f2 | cut -d"<" -f1))'"

might have to add other meta info the the query to ignore directories, special files and the like...

The kMD* keys are documented here: http://developer.apple.com/library/mac/#documentation/Carbon/Reference/MetadataAttributesRef/Reference/CommonAttrs.html#//apple_ref/doc/uid/TP40001694-SW1

Answer 5

if you know when the last backup run was, you can list files changed after that:

For example, to find all files in /folder with .doc as the extension that were modified less than two days ago:

find /folder -iname "*.doc" -mtime -2

Answer 6

1: Parse the last backup time from the folder names on the Time Machine backup volume. Use the one the "latest" link points to, if possible. Dismiss those with ".progress" extension (not on a Mac right now, so I could be off a little)

2 and 3: Read the property lists and use them as exclusion file, if possible, or simply create a regular expression from those paths and "grep -v $excluded".