It'd be useful to see what Time Machine will backup before the backup actually occurs. I believe it should be possible to approximate this with
mdfind. Is there a standard search query that accomplishes this? Or a way to ask Time Machine directly?
In OS X 10.7 (Lion) you can use
tmutil. To compare the current state of the machine with the most recent backup you simply use the command,
But you'll probably want to redirect the output to a file because there may be a lot of it. You can restrict the comparison to certain types of difference (e.g., file size, file permissions). It does more, but I can't describe the details more succinctly than the
tmutil man page itself:
compare [-@esmugtdrvEX] [-D depth] [snapshot_path | path1 path2] Perform a backup diff. If no arguments are provided, tmutil will compare the computer to the latest snapshot. If a snapshot path is provided as the sole argument, tmutil will compare the computer to the specified snap- shot. If two path arguments are provided, tmutil will compare those two items to each other. tmutil will attempt to inform you when you have asked it to do something that doesn't make sense or isn't supported. The compare verb allows you to specify what properties to com- pare. If you specify no property options, it is assumed that you want to compare a basic set of metadata. This default property set is equivalent to the -smugt option set. Specifying any prop- erty option overrides the default set. Options: -a compare all suppored metadata -@ compare extended attributes -e compare ACLs -s compare sizes -m compare file modes -u compare UIDs -g compare GIDs -t compare modification times -d compare file data forks -r ignore specified root paths and compare descendents instead -D limit traversal depth to depth levels from the begin- ning of iteration -E don't take exclusions into account when comparing items inside volumes -v enable verbose mode (enables reporting of all identical items, which is noisy) -X print output in XML property list format
The other answer mentioning
tmutil compare is the canonical way to ask OS X to simulate the next backup event and check which files and/or metadata have changed since the last backup. However, there is a very useful binary called
tmdiagnose that I haven't seem mentioned here on SuperUser which is intended for diagnosing issues with Time Machine that will also let you know in excruciating detail the configuration for the next backup, the system exclusion paths, the user exclusion paths as well as what rules were used on all prior backup and snapshot events.
Look inside the
hostname -s.tmdiagnostic.zip file for both the configuration.txt as well as the exclusions.plist text files to determine which files and paths are and were excluded.
I have the same question. Since there does not appear to be an exact answer, let me propose this:
- Allow Time Machine to make the backup.
- Look inside of it using BackupLoupe to see what was backed up.
- If you're not happy with it, adjust the exclusions.
- If you want to delete the snapshot, mount the
sparsebundlefile by clicking on it, then browse to the snapshot you don't want and remove it.
Something like this could be used as a starting point
mdfind "kMDItemContentModificationDate >= '\$time.iso($(cat /Private/var/db/.TimeMachine.Results.plist | grep "BACKUP_COMPLETED_DATE" -A1 | grep "<date>" | cut -d">" -f2 | cut -d"<" -f1))'"
might have to add other meta info the the query to ignore directories, special files and the like...
if you know when the last backup run was, you can list files changed after that:
For example, to find all files in
.doc as the extension that were modified less than two days ago:
find /folder -iname "*.doc" -mtime -2
1: Parse the last backup time from the folder names on the Time Machine backup volume. Use the one the "latest" link points to, if possible. Dismiss those with ".progress" extension (not on a Mac right now, so I could be off a little)
2 and 3: Read the property lists and use them as exclusion file, if possible, or simply create a regular expression from those paths and "grep -v $excluded".