21

I'm wondering if I can access my time machine backup from Windows or Linux computers... I'm just wondering what'll happen if my computer fails and I don't have enough money to buy a new mac...

Improve this question
1
  • iiegn has a python script that tries to automate the restoring process. I didn't try it yet though.
    – Catalin Hritcu
    Commented Aug 27, 2012 at 3:21

6 Answers 6

Reset to default
17

It CAN be read from linux (By using Ubuntu for example) but it is a tough nut to crack. Windows can't do it at all.

The following commands need to be executed as a privileged user. To gain the necessary rights do

$ sudo su

You should then be prompted with the root shell.

The following came from http://hints.macworld.com/article.php?story=20080623213342356

It turns out Apple does a couple slick things with the file system to make incremental backups work, including hard linking to directories, which isn't allowed in Linux. So for anyone that needs to access their Time Machine from something other than its associated Mac, here's how you do it...

1 - Mount the drive. On linux, it should automount if you have gnome-volume-manager installed. If you don't see it in /media, then run nautilus and check the desktop. Still don't see it? Read man mount. And then don't forget the -t hfsplus flag.

2 - Change directory. My mount point is /media/Time Machine/. Within that path, I find the directory Backups.backupdb. This represents the directory layout of your backup system. Inside that directory is the name of your disk. Inside that are folders labeled with dates corresponding to each incremental backup that was made. Pick the one you want, or choose the Latest symlink. For example, my path is now:

/media/Time Machine/Backups.backupdb/Drive 1/2008-06-05-073745

3 - Find your file's folder. Within that path is a complete representation of your filesystem. Navigate to the location of your file. If it's not too big or nested too deep, it may be plainly visible. However, there's a good chance that its parent directory doesn't exist. Instead you'll see a zero-byte file for the parent that takes its name and acts as a pointer. Run ls -l and take note of the first numbered column. Example:

...
-r--r--r-- 2155704 root 5791966       0 2007-06-25 02:54 Wallpaper
-r--r--r-- 2155725 root 5791967       0 2007-06-25 02:54 Web-Identity
-r--r--r-- 5441953 root 5791968       0 2007-06-25 02:54 Windows
-r--r--r-- 5511926 root 5791969       0 2007-06-25 02:54 Work

After the permissions, you'll see the directory number that typically refers to the number of directories within that folder. For a file, it should always be 1, but here it is not. What Apple has done is adjust the information in this file's inode to use it as a pointer to the directory that contains the actual file. That way, multiple revisions of the same drive can coexist without duplicating data.

4 - Find the data. In my case, I want to grab something out of the Wallpaper folder. First I made a note of the directory number, 2155704, and then did cd /media/Time Machine/.HFS+ Private Directory Data -- this is where the data really lives. From there, I just did cd dir_2155704, and voilà !

Improve this answer
1
  • It is the way to go. you saved my day! I managed to recover some documents from an old time machine backup five years ago. Thanks you so much
    – Boson Bear
    Commented Aug 15, 2020 at 14:12
7

I found another script, that creates a read-only FUSE Overlay to implement the TM hardlinking mechanism:

https://github.com/isnotajoke/fuse-time-machine

Improve this answer
5

I've written a script to automate this pain. Find it here: https://gist.github.com/vjt/5183305

Improve this answer
4

Besides the FUSE file system for Time Machine backups mentioned by strfry and written by Kevan Carstensen, there exists an implementation by Ron Pedde. In my case the implementation by Carstensen could not properly resolve all links. The one by Pedde worked flawlessly including accessing older versions of the backed up files. Both implementations require you to install python-fuse. For Debian-based Linux distributions the following should do:

sudo apt-get install python-fuse

Then assuming your backup disk got automounted to /media/jonesdoe/backup-disk you should be able to mount it using tmfuse.py like so:

cd ~jonesdoe
wget https://raw.githubusercontent.com/rpedde/tmfuse/master/tmfuse.py
mkdir mybackup
python tmfuse.py /media/jonesdoe/backup-disk mybackup/
cd mybackup/somehostname/Latest/Macintosh HD

As for Windows, superuser QA: Opening Time-Machine OSX backup files on Windows 7? seems to answer the question.

Improve this answer
1

I recently put together the rpedde/tmfuse solution with torarnv/sparsebundlefs in a docker container with some scripts. It is available here: https://github.com/taborkelly/timemasheen

Improve this answer
1
  • 1
    Really useful to bundle everything in a docker! I didn't need the sparsebundlefs, so the scripts only worked as an example, but still, this was really useful!
    – jcoll
    Commented May 27, 2023 at 7:29
0

I found that I needed to mount the .sparsebundle file found on the network drive first.

On Unix:

  1. Follow all the instructions in https://github.com/torarnv/sparsebundlefs the README (read all the subsections, will likely need to follow the steps in the permissions and partition offset sections).
  2. Read and follow the steps in the answer by @Pylsa, or use https://github.com/abique/tmfs (again read and follow all instructions).

The complete apt dependencies that I needed to build these 2 repos from source were:

sudo apt install libfuse-dev fuse cmake build-essential git curl

On Windows:

  • Untested, but the above procedure may work with Windows Subsystem for Linux 2 (WSL2).
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .