10.5: Compare Time Machine backups to original drive

I wanted to see how good Time Machine was at keeping a complete backup, so I ran a diff between my disk and its latest backup. I was quite shocked to find that there were differences in places other than caches, logs, etc. which Time Machine does not back up.

Time Machine has forgotten to backup (i.e. the latest backup still contains the old version) two of my applications that I updated by downloading new versions in a DMG and copying them to /Applications, and also a Widget in my ~/Library folder. I also found a document in my documents folder that was backed up with the same modification date as the original, but with different content. This is very bad.

If you want to check your Time Machine backup, run the following command:

sudo diff -qr / /Volumes/time_machine_volume/Backups.backupdb/machine_name/Latest/drive_name >diff-time-machine.dat

Replace time_machine_volume, machine_name, and drive_name with the proper values for your machines. You may want to run this at night, as the heavy disk activity will slow down your machine. Then look at the output to see what (if anything) Time Machine has missed. There are obvious missing things like logs and caches; what may be interesting are the other differences, if any.

Note that I have not had a single crash since Leopard, and that the filesystems on both my system drive and Time Machine's are fine. Also, I have not excluded anything from my Time Machine Backups.

From our Sponsor...

The macosxhints Poll

iPad_poll_#1

10.5: Compare Time Machine backups to original drive | 18 comments | Create New Account

Click here to return to the '10.5: Compare Time Machine backups to original drive' hint

The following comments are owned by whomever posted them. This site is not responsible for what they say.

10.5: Compare Time Machine backups to original drive
Authored by: patpro on Fri, Nov 23 2007 at 8:32AM PST

oops.
That's bad. It looks like time machine is as phony as the new firewall: the box says "don't worry, we handle it !", and the truth is they don't, and you should worry.

I wonder how Apple can screw things like this. Too bad :(
(I've mismatch in /Applications/Adobe Photoshop CS3/... and diff is still running)

---
http://www.patpro.net/

10.5: Compare Time Machine backups to original drive
Authored by: wfolta on Fri, Nov 23 2007 at 12:06PM PST

It looks like time machine is as phony as the new firewall: the box says "don't worry, we handle it !", and the truth is they don't, and you should worry.

First, the application firewall is a step forward in terms of usability. More users will be more secure with something that works as they expect: per-application/service permissions.

Second, the "phoney" was a miscommunication in terms of what the firewall was doing. It was more secure than initial investigators assumed, because they did not account for things like sandboxing of the "critical" services that could not be shut off. There was a bug where changes were not immediately reflected (running applications were not affected), but that was fixed in 10.5.1.

Third, the "critical" services that cannot be turned off in the firewall are sandboxed -- another new security feature in Leopard.

Fourth, 98% of Mac users do not understand ipfw rules or their implications. I've got a computer science degree, and it's still difficult to have a bullet-proof ipfw ruleset and it's easy to have things fail that then take elaborate debugging to fix. When security is burdensome, people turn it off, resulting in an overall lowering of security.

Fifth, ipfw is still included with Leopard and you can turn it on in addition to the application firewall. They work hand-in-hand.

[ Reply to This | # ]

10.5: Compare Time Machine backups to original drive
Authored by: jawadde on Fri, Nov 23 2007 at 12:10PM PST

wow... while your find is sad, scary and dangerous, I am VERY glad you found this ! Why did none ever test this ?

I'm gonna submit it on Digg, hoping it hits the frontpage and reaches Apple PR, so they can release a Software Update. If they do so, I hope someone will run this check again ! (I can't , as I have no external drive for time machine)

10.5: Compare Time Machine backups to original drive
Authored by: adrianm on Fri, Nov 23 2007 at 12:18PM PST

Or file a bug report with Apple... whatever works for you.

---
~/.sig: not found

10.5: Compare Time Machine backups to original drive
Authored by: wfolta on Fri, Nov 23 2007 at 12:18PM PST

Ummm... you really should not report an issue that you cannot yourself confirm.

Until the original poster posts specific error messages and procedures, I am skeptical that they are in fact seeing something other than what they reported. My backup is perfect, though I did get messages out of diff that took investigation to see that diff was somehow confused.

I've installed a couple dozen applications from DMG files, for example, with no errors. Please wait until there are multiple confirmations of an issue before you try to smear it all over front pages of other sites -- without even confirming it yourself.

10.5: Compare Time Machine backups to original drive
Authored by: adrianm on Sun, Nov 25 2007 at 12:44AM PST

Well, I tested it and confirmed it. It wasn't hard.
Regardless of diff's flaws, it's still easy to find files that have changed but not backed up.

---
~/.sig: not found

10.5: Compare Time Machine backups to original drive
Authored by: cawaker on Fri, Nov 23 2007 at 6:37PM PST

that was sarcasm right? are you kidding me?

That is the most irresponsible knee-jerk reaction to a preliminary, unconfirmed minor issue i've ever seen.

10.5: Compare Time Machine backups to original drive
Authored by: wfolta on Fri, Nov 23 2007 at 12:14PM PST

I found no problems with mine.

What kind of error indications did you get? You have to be careful that you're not seeing diff issues as opposed to actual differences. Time Machine uses various UNIX tricks to avoid making backups of unchanged files, and I believe that the recursive diff can have problems with that.

Also, I saw issues with file names that had special characters in them, specifically colons and parenthesis. These characters need to be escaped in the Terminal shell, but not in Finder, and recursive diff may have a bug in it where it does not properly handle the filename. The files were there, though diff reported that they were not in the backup.

10.5: deficient Time Machine backups
Authored by: Barry Gumbiner on Fri, Nov 23 2007 at 1:41PM PST

Even worse, Time Machine does not adequately back up your drive sufficiently to restore it to a useful state. I have now tried this twice (with leopard server software), and although the restore from Time machine created a bootable volume, it failed to create ANY user accounts (both times!). Basically, I observed that I couldn't log on - and time a tech support person had me log on as root (after reseting password via install disk) - and NO user accounts showed up.

10.5: deficient Time Machine backups
Authored by: captainproton on Fri, Nov 23 2007 at 3:59PM PST

>it failed to create ANY user accounts (both times!)

That's odd. I had an hdd go down last week on my macbook (horrible horrible grinding sounds, brought tears to my eyes).

Restored from the Time Machine backup, and everything was as it should be.

In short, works for me - user accounts and all.

10.5: Compare Time Machine backups to original drive
Authored by: qrulf on Fri, Nov 23 2007 at 1:49PM PST

Wow, I had a similar problem, posted on apple-discussions:

http://discussions.apple.com/thread.jspa?threadID=1252068

10.5: Compare Time Machine backups to original drive
Authored by: macpinoy on Fri, Nov 23 2007 at 3:56PM PST

I was able to do a full restore from TM backups:

http://www.macpinoy.com/2007/11/04/day-2-restoring-from-time-machine/

10.5: Compare Time Machine backups to original drive
Authored by: geohar on Sat, Nov 24 2007 at 5:08AM PST

The full log of my diff contained a few errors.

However, on closer investigation, the errors either relate to symlinks which various apps (eg VLC) have but are genuinely broken in the downloaded package.

The other sort were symlink which were relative and had been accurately preserved in the backup, but genuinely didn't exist.

Have you ever disabled (turned off) time machine rather than just having the drive unplugged?

My backup seems very accurate - and yes it does appear that diff gets confused by a few things.

For one, I think that code signing is responsible for differences in any App binaries.

Cheers

George

10.5: Compare Time Machine backups to original drive
Authored by: rusakko on Sat, Nov 24 2007 at 11:31AM PST

I ran the diff-test and found that the following files differ by exactly one byte:

/Library/Documentation/Applications/iPhoto/iPhoto Getting Started.app/Contents/MacOS/iPhoto Getting Started /System/Library/PrivateFrameworks/MobileDevice.framework/Resources/ApplemobileDeviceHelper.app/Contents/MacOS/AppleMobileDeviceHelper .. [ bunch of other files under AppleMobileDeviceHelper.app ] ..

Is there any explanation why there would be a one byte difference in these files?

[ Reply to This | # ]

10.5: Compare Time Machine backups to original drive
Authored by: PatrickS on Sun, Nov 25 2007 at 12:10AM PST

Same result here:

/Library/Documentation/Applications/iPhoto/iPhoto Getting Started.app/Contents/MacOS/iPhoto Getting Started /System/Library/PrivateFrameworks/MobileDevice.framework/Resources/AppleMobileDeviceHelper.app/Contents/MacOS/AppleMobileDeviceHelper /System/Library/PrivateFrameworks/MobileDevice.framework/Resources/AppleMobileSync.app/Contents/MacOS/AppleMobileSync /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/AppleMobileDeviceHelper.app/Contents/MacOS/AppleMobileDeviceHelper /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/AppleMobileSync.app/Contents/MacOS/AppleMobileSync /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/Current/Resources/AppleMobileDeviceHelper.app/Contents/MacOS/AppleMobileDeviceHelper /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/Current/Resources/AppleMobileSync.app/Contents/MacOS/AppleMobileSync

[ Reply to This | # ]

10.5: Compare Time Machine backups to original drive
Authored by: Wodgy on Sat, Nov 24 2007 at 12:11PM PST

Good hint. I ran it and I'm not seeing any important differences, which is reassuring.

Details?
Authored by: wfolta on Sun, Nov 25 2007 at 4:40PM PST

Ummm... I have yet to see any details in this thread of all those differences people supposedly are finding.

As someone else notes, there are diff issues with some of the UNIX tricks Time Machine uses to not back up stuff that has not changed (multiple hard links) and also with circular symlinks.

If you did confirm it, how about posting what you found?

10.5: Compare Time Machine backups to original drive
Authored by: leraillez@netinf on Mon, Nov 26 2007 at 12:53AM PST

Did you check the applications dates because some have the same creation/modification dates as the previous version and I see no reason to copy them again.

Hint Options

Search

From our Sponsor...

User Functions

What's New:

Hints

Comments last 2 days

Links last 2 weeks

What's New in the Forums?

The Editor's Corner...

Hints by Topic

News from Macworld

The macosxhints Poll