Pick of the Week - Nov 10 [Show all picks]
Path Finder 5 - A feature-laden Finder replacement
Submit Hint Search The Forums LinksStatsPollsFAQHeadlinesRSS
12,000 hints and counting!

10.5: View exactly which files Time Machine backed up System 10.5
You may occasionally notice Time Machine is backing up an unexpectedly large amount of data, or maybe you're just curious as to what actually changed between backups. Perhaps you'd like to tailor your exclusion list to keep the backup size down. Unfortunately, the Time Machine interface provide no means to find out what it is actually being backed up. Luckily, we can use the fact that Time Machine creates hard links of unchanged files to explore what it did back up, after the fact. timedog is a Perl script (4KB download) which does just that. Use it like so:
$ cd /Volumes/TM/Backups.backupdb/myhost
$ timedog -d 5 -l
By default, timedog will examine the most recent backup, compare it to the one prior, and report all changed files. The -d flag controls the directory depth of reporting, -l disables reporting for symbolic links (for which Time Machine seems to create a new copy of the link each backup). You can also specify a backup of your choice as an argument, though it must also have one prior backup with which to compare.

This script should be safe, but standard warnings apply regarding mucking with your TM database.

[robg adds: I haven't tested this one; the script should already be marked as executable, so it should run after download without any changes.]
    •    
  • Currently 0.00 / 5
  • 1
  • 2
  • 3
  • 4
  • 5
  (0 votes cast)
 
[14,819 views]  

10.5: View exactly which files Time Machine backed up | 15 comments | Create New Account
Click here to return to the '10.5: View exactly which files Time Machine backed up' hint
The following comments are owned by whomever posted them. This site is not responsible for what they say.
10.5: View exactly which files Time Machine backed up
Authored by: magir on Thu, Jul 17 2008 at 9:04AM PDT
As an alternative you can use TimeTracker by the author of Pacifist. It's just a hack, so don't blame him, when it doesn't work. At least for me it works great, displaying recent backups along with the size of the backed up folders.

http://www.charlessoft.com/TimeTracker.zip


[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: fracai on Thu, Jul 17 2008 at 11:03AM PDT
Another alternative is tms which lets you treat the Time Machine backup as if it were a version control system like cvs.

---
i am jack's amusing sig file

[ Reply to This | # ]

10.5: View exactly which files Time Machine backed up
Authored by: clh on Thu, Jul 17 2008 at 5:35PM PDT
I don't see Backups.backupdb in /Volumes/ProfGizmo/. Only thing there is a blah.sparseimage "file."

[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: jdsmith on Mon, Jul 21 2008 at 12:05PM PDT
Sounds like a network drive (which is what I have as well). Mount the sparse image, and then operate inside of that mounted volume.

[ Reply to This | # ]
Enh Req: View exactly which files Time Machine backed up
Authored by: scottbayes on Thu, Jul 17 2008 at 9:03PM PDT
This is functionality I've been looking for for quite a while now. Thank you!

One small request, since I'm not Perl-literate: please add a -n or some such option to format the output in a more machine-friendly format, as:

3126 3157 /Macintosh HD/Library/Preferences/SystemConfiguration/com.apple.network.identification.plist

(with nice wide fields like %15d or something, and maybe with TAB as field separator) instead of:

3.1KB-> 3.1KB /Macintosh HD/Library/Preferences/SystemConfiguration/com.apple.network.identification.plist

Would make it easier to pipe to sort(1) or cut(1) or load as csv into Excel, etc. I'd usually like to see my top N big updates.

I think the current format should remain the default, my suggestion is for geeks.


[ Reply to This | # ]
Enh Req: View exactly which files Time Machine backed up
Authored by: jdsmith on Wed, Jul 23 2008 at 9:19AM PDT
Here's an update with -n and which reports the number of changed contents for summarized directories (with -d).

#!/usr/bin/perl
#
# timedog
#
#   J.D. Smith (jdtsmith A@T gmail _dot_ com)
#
# Display the files which time machine backed up in its most recent
# backup (or any of your choosing).  Uses the fact that Time Machine
# creates hard links for unchanged files and directories.  Reports old
# and new sizes of the changed files, along with the total file count
# and backup size.
#
# Usage:  timedog [-d depth] [-l] [-n] [latest]
#
#   N.B. You must first mount the time machine volume, and change to
#   the directory containing your time machine backup directories, the
#   ones named like 2008-07-14-112245/.  This can be found in the
#   directory /Volumes/TM/Backups.backupdb/hostname or similar.
#
#     latest: The backup directory for which you'd like to see the
#             changed contents.  Defaults to the most recent (the one
#             linked to by Latest)
#
#         -l: Omit symbolic links from the summary.  For whatever
#             reason, Time Machine creates a new version of a symbolic
#             link each and every time it backs up.
#
#         -n  Use simple fixed width formatting, and omit summaries.
#
#   -d depth: By default, all files are printed, which can get
#             lengthy.  With this option, summarize changes in
#             directories only down to the given depth.  The number of
#             files and subdirectories which changed will be reported
#             as [n].
#
# Example:
#   % cd /Volumes/TM/Backups.backupdb/myhost
#   % timedog -d 5 -l
#
###############################################################################
# 
# LICENSE
#
#  Copyright (C) 2008 J.D. Smith
#
#  This file is free software; you can redistribute it and/or modify
#  it under the terms of the GNU General Public License as published
#  by the Free Software Foundation; either version 2, or (at your
#  option) any later version.
#
#  This File is distributed in the hope that it will be useful, but
#  WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
#  General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this file; see the file COPYING.  If not, write to the
#  Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
#  Boston, MA 02110-1301, USA.
#
###############################################################################


use File::Find;
use Fcntl ':mode';
use Getopt::Std;

getopt('d');

sub bytes {
  my $bytes=shift;
  $format=shift || ".1";
  @suff=("B","KB","MB","GB","TB");
  for ($suff=shift @suff; $#suff>=0 and $bytes>=1000.; $suff=shift @suff) {
    $bytes/=1024.;
  }
  return int($bytes) . $suff if int($bytes)==$bytes;
  return sprintf("%${format}f",$bytes) . $suff;
}

sub summarize {
  ($size,$size_old,$old_exists,$name,$cnt)=@_;
  if ($opt_n) {
    printf "%12d %12d %s\n",$old_exists?$size_old:0,$size,$name;
  } else {
    if ($opt_d) { 
      printf "%9s->%9s %6s %s\n",$old_exists?bytes($size_old):"....  ",
	bytes($size),$cnt?"[$cnt]":"",$name;
    } else {
      printf "%9s->%9s %s\n",$old_exists?bytes($size_old):"....  ",
	bytes($size),$name;
    }
  }
}


opendir DIR,"." or die "Can't open directory.";
@files=sort grep {m|[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]+$|} readdir(DIR);
die "None or only one Time Machine backups found." if @files == 1;

if (@ARGV) {
  $latest=$ARGV[0];
  $latest=~s|/$||;
  foreach (@files) {
    last if $_ eq $latest;
    $last=$_;
  }
  die "Invalid backup directory" if !defined($last) || $last eq $latest;
} else {
  ($last,$latest)=@files[$#files-1..$#files];
}

print "==> Comparing TM backup $latest to $last\n" unless $opt_n;

my ($old_exists,$rold_exists,$rsize,$rsize_old);
$total_size=0;
$total_cnt=0;

find({wanted =>
      sub{
	($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size) =
	  lstat($_);
	($old=$_)=~s/^$latest/$last/;
	if (-e $old) {
	  ($dev, $ino_old,$mode_old,
	   $nlink,$uid,$gid,$rdev,$size_old) = lstat($old);
	  if ($ino == $ino_old) { # Prune matching
	    $File::Find::prune=1 if -d;
	    return
	  }
	  $old_exists=1;
	} else {$old_exists=0;}


	$total_size+=$size;

	$link=S_ISLNK($mode);
	return if $opt_l && $link;

	# Don't include links in the count
	$total_cnt++;
	($name=$_)=~s/^$latest//;

	if ($opt_d) {
	  $depth=$name=~tr|/||;
	  $rsize+=$size;
	  $rsize_old+=$size_old if $old_exists;
	  $rcnt++;
	  return if S_ISDIR($mode) || $depth > $opt_d; # Post will handle
	}
	$name.="/" if S_ISDIR($mode);
	$name.="@" if $link;
	summarize($size,$size_old,$old_exists,$name);
      },
      preprocess =>
      (!$opt_d)?0:
      sub{
	$depth=$File::Find::dir=~tr|/||;
	if ($depth<=$opt_d) {
	  # Starting a new printable directory; zero out sizes
	  $rsize=$rsize_old=$rcnt=0;
	  $rold_exists=-e $File::Find::dir;
	}
	@_;
      },
      postprocess =>
      (!$opt_d)?0:
      sub{
	$depth=$File::Find::dir=~tr|/||;
	return if $depth > $opt_d;
	# This directory is at or below the depth, summarize it
	($name=$File::Find::dir)=~s/^$latest//;
	summarize($rsize,$rsize_old,$rold_exists,$name.'/',$rcnt)
	  if $rsize || $rsize_old;
	$rsize=$rsize_old=$rcnt=0;
      },
      no_chdir => 1}, $latest);

print "==> Total Backup: $total_cnt changed files/directories, ",
  bytes($total_size,".2"),"\n" unless $opt_n;


[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: mmacho on Fri, Jul 18 2008 at 12:51AM PDT
Is there some way of knowing which files will be backed up?? That is for me much more interesting than this.

[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: homeshire on Fri, Jul 18 2008 at 3:51AM PDT
I can't get this to work for me. I'm sure it's because I know nothing about perl, so there is something I'm missing. I think terminal still launches for me with a tcsh shell, and this script may be for a bash shell. In any event, something's amiss whenever I try. Pity, I really want what this script offers.

Particularly frustrating in that the immediate comment after the hint says it is immediately executable without any changes.

But my purpose here is to say thanks for the tip on TimeTracker. I tried it, and in 30 seconds I had the long-sought answer to why my Time Machine has been saving gigs of data when I have done little to nothing since the previous backup. That's all I wanted, and I got it here in this tip, if indireclty.

[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: jdsmith on Mon, Jul 21 2008 at 12:06PM PDT
See the comment below: good summary for non-terminal types.

[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: V.K. on Fri, Jul 18 2008 at 2:34PM PDT
very nice but instructions for non terminal savvy people are in order. the first command should be
cd "/Volumes/TM-drive-name/Backups.backupdb/myhost"
instead of TM-drive-name put the name of your TM drive. instead of myhost put the name of your computer. It can be found in system preferences->sharing. In the second command you need to specify the full path to unix executable timedog. if after you unzip the download you put it on your desktop the command would be
~/Desktop/timedog -d 5 -l

[ Reply to This | # ]
Filter by size
Authored by: SeanAhern on Thu, Jan 22 2009 at 12:33PM PST
I made a modification to allow you to filter by size, letting you filter out tiny file changes. This lets me easily see what are the big changes that are eating up my drive.

[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: jdsmith on Fri, Jan 23 2009 at 3:50PM PST
Timedog has a new home on Google Code.

Check there for the latest versions.

[ Reply to This | # ]

10.5: View exactly which files Time Machine backed up
Authored by: palahala on Fri, Jul 10 2009 at 4:35AM PDT

Note that, even when running as an admin user, sometimes timedog and TimeTracker need to be run as root to see all files. When not doing that, one might for example not take the backups of MySQL logs and data into account:

cd "/Volumes/Backup of Palahala/Backups.backupdb/Palahala/Latest"
sudo ls -l "Macintosh HD/usr/local/mysql-5.0.51a-osx10.5-x86"
[..]
drwxr-x---@  6 _mysql  wheel    374 Jul  2 20:05 data

In those cases both timedog and TimeTracker will report a lower total backup size and less files than the backupd logs in Console (easily shown using the Time Machine Buddy widget), or the (different) log that is kept in the hidden .Backup.log file on the backup disk.

So, for timedog:

cd "/Volumes/Backup of Palahala/Backups.backupdb/Palahala" 
sudo ~/Downloads/timedog

Likewise, for TimeTracker:

sudo TimeTracker.app/Contents/MacOS/TimeTracker

[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: palahala on Thu, Jul 16 2009 at 3:46PM PDT

As BlaatMekker also referred to this hint in 10.5: One possible cause of huge Time Machine backups, let's mention yet another tool to find large files on your disk: Disk Inventory X.

This program has nothing to do with Time Machine, but may help investigating problems, like when you wonder why your backup is a lot smaller than the space used on your hard disk. Note that this program will probably always report less total disk space in its window title than in its screen where one can select which disk to investigate (even when running as root and choosing menu View, Show Physical File Size). But if the reported total size is really a lot smaller than the actual totals used on your Mac, then it may help to run as root:

sudo "/Applications/Utilities/Disk Inventory X.app/Contents/MacOS/Disk Inventory X"


[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: nick_harambee on Mon, Aug 17 2009 at 8:30AM PDT
hi

could someone please tell me how to specify which backup to load/compare using timedog, i.e. i would like to analyse specific backups rather than just the last one

thanks

nick

[ Reply to This | # ]