As I understand it, Time Machine creates hard links for all the previous files in a backup, so each timestamped backup folder appears as a full snapshot of the files at the time of the backup. How can I find out which files are new for a given backup and which files were carried forward from the previous backup?
Asked
Active
Viewed 333 times
3
-
See also the notes on `timedog` (command line) and TimeTracker (GUI) at [Verifying Time Machine backups](http://superuser.com/questions/47628/verifying-time-machine-backups/87591#87591). – Arjan Apr 30 '10 at 06:25
3 Answers
1
If Time Machine is actually using hard links, you can use 'ls -l' to display the link count for a file. In theory, new files will have a link count of 1. For example:
$ touch foo
$ ls -l foo
-rw-r--r-- 1 lars staff 0 Dec 4 00:22 foo
The second field is the link count. Let's create a link:
$ ln foo bar
$ ls -l foo bar
-rw-r--r-- 2 lars staff 0 Dec 4 00:22 bar
-rw-r--r-- 2 lars staff 0 Dec 4 00:22 foo
Note that the link count has increased.
You can use the 'find' command to find all files with a single link:
$ find /path/to/backup -links 1 -print
larsks
- 4,053
- 28
- 36
-
That's what I thought, too, but it's not that easy. If a *folder* has been "carried forward," then there will be a hard link to just the folder. The files in the folder won't have additional links, so if a folder remains unchanged for several backups, the link counts for those files will remain at 1 even though they're actually very old. – Rob Kennedy Dec 04 '09 at 05:38
1
BackupLoupe is $1, excellent, and does just this.
And yes, it does use hard links. This article (part of a 10.5 review on arstechnica) explains how Time Machine works and is a very interesting read.
ridogi
- 2,947
- 1
- 19
- 24
