Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

How to access Time Machine files from Linux UNIX
Recently after switching from Mac OS X to Debian, I found I needed to restore a couple files from the Time Machine backup that I kept. The drive works just fine as an HFS+ mount, but I couldn't figure out how to retrieve anything within. When Google didn't yield the answer, I began to explore on my own.

It turns out Apple does a couple slick things with the file system to make incremental backups work, including hard linking to directories, which isn't allowed in Linux. So for anyone that needs to access their Time Machine from something other than its associated Mac, here's how you do it...

[robg adds: The following details were reproduced (with minor editing) using the author's original blog post, with his permission.]

  1. Mount the drive. On linux, it should automount if you have gnome-volume-manager installed. If you don't see it in /media, then run nautilus and check the desktop. Still don't see it? Read man mount. And then don't forget the -t hfsplus flag.
  2. Change directory. My mount point is /media/Time Machine/. Within that path, I find the directory Backups.backupdb. This represents the directory layout of your backup system. Inside that directory is the name of your disk. Inside that are folders labeled with dates corresponding to each incremental backup that was made. Pick the one you want, or choose the Latest symlink. For example, my path is now:
    /media/Time Machine/Backups.backupdb/Drive 1/2008-06-05-073745
  3. Find your file's folder. Within that path is a complete representation of your filesystem. Navigate to the location of your file. If it's not too big or nested too deep, it may be plainly visible. However, there's a good chance that its parent directory doesn't exist. Instead you'll see a zero-byte file for the parent that takes its name and acts as a pointer. Run ls -l and take note of the first numbered column. Example:
    ...
    -r--r--r-- 2155704 root 5791966       0 2007-06-25 02:54 Wallpaper
    -r--r--r-- 2155725 root 5791967       0 2007-06-25 02:54 Web-Identity
    -r--r--r-- 5441953 root 5791968       0 2007-06-25 02:54 Windows
    -r--r--r-- 5511926 root 5791969       0 2007-06-25 02:54 Work
    After the permissions, you'll see the directory number that typically refers to the number of directories within that folder. For a file, it should always be 1, but here it is not. What Apple has done is adjust the information in this file's inode to use it as a pointer to the directory that contains the actual file. That way, multiple revisions of the same drive can coexist without duplicating data.
  4. Find the data. In my case, I want to grab something out of the Wallpaper folder. First I made a note of the directory number, 2155704, and then did cd /media/Time Machine/.HFS+ Private Directory Data -- this is where the data really lives. From there, I just did cd dir_2155704, and voilĂ !
[robg adds: I haven't tested this one.]
    •    
  • Currently 3.47 / 5
  You rated: 2 / 5 (17 votes cast)
 
[35,149 views]  

How to access Time Machine files from Linux | 13 comments | Create New Account
Click here to return to the 'How to access Time Machine files from Linux' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
How to access Time Machine files from Linux
Authored by: deviantintegral on Jun 26, '08 08:12:06AM

Thanks for the hint, it's really useful.

Has anyone managed to mount a sparsebundle on linux?

--Andrew



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: PhaseShift on Jun 30, '10 03:37:46PM

I'm getting "Permission Denied" when trying to view the folder, or cd to it in the terminal. Maybe I'm having a dumb attack, but how do I get around this?



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: PhaseShift on Jun 30, '10 04:30:11PM

Actually, nevermind. I figured it out. For a number of the files in the Time Machine backup, you must be root to view them. That actually caused me some trouble, since I didn't remember setting a root password when installing Ubuntu. Here's what I did:

1) Log in with my regular ubuntu account
2) Open a terminal and type "sudo sh" (with no quotes. this will create a shell session with you as the root user).
3) type "passwd" (no quotes)
4) enter a new password for your root account
5) type "exit" to go back to your normal terminal session

Now you should be able to log in as root at the ubuntu login screen (using your new password). You will be able to browse the once-blocked files and directories.

NOTE: If you copy any files from the Time Machine drive that you only have permission to view as root, you better make sure to use the CHMOD command in the terminal (while you're still logged in as root) to change the permissions. Otherwise, you'll do something like copy a file to your desktop, log back in to your regular user name, and then wonder why you're still getting "Permission Denied".

For those who aren't chmod-savvy you can type "chmod a+rw FILENAME" without quotes in the terminal to change FILENAME to read and write access for all.



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: shabiel on Aug 06, '10 03:29:18AM

Thank you so much!!! I have been looking for this all over because my Mac crashed and now I am using my favorite OS...



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: lostsync on Nov 12, '10 10:55:57PM
I know this is an old tip but just wanted to add my $0.02. Hint does indeed work as described, but it's also important to note that...well my particular case was this:
  1. I needed a file from a subfolder on my desktop.
  2. Followed the hint, found my desktop.
  3. Subfolder didn't exist
  4. Followed the hint, found my subfolder
  5. File was within
So, you may need to find the 'magic folder' more than once to get at what you're looking for.

Also, most people using this hint are probably on Ubuntu or a related OS - there is no root password by design. You'll need to use
sudo passwd root
to give the root account a password before you are able to use it. sudo is required to do much of anything with the Time Machine volume and using the root account will be helpful if you aim to deal with more than one or two files. Consider disabling it again when you are done - Ubuntu turns it off for a reason and it really isn't needed by 99% of users 99% of the time.

[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: scragz on Dec 05, '10 08:35:53PM

Also, most people using this hint are probably on Ubuntu or a related OS - there is no root password by design. You'll need to use

sudo passwd root

to give the root account a password before you are able to use it. sudo is required to do much of anything with the Time Machine volume and using the root account will be helpful if you aim to deal with more than one or two files. Consider disabling it again when you are done - Ubuntu turns it off for a reason and it really isn't needed by 99% of users 99% of the time.

You might be interested to know about sudo shell mode. `sudo -s` will get you a root shell.

[ Reply to This | # ]

How to access Time Machine files from Linux
Authored by: jeromemac75 on Dec 10, '10 12:50:46PM
I made a little script to automise the retrivieng of files. Hope this helps.
#!/bin/bash
#set -e
#
#---------------------------------------------------------
# Simple script to get files in an Apple Time Machine (TM) archive. Inspired by http://hints.macworld.com/article.php?story=20080623213342356
#
# You need to have rsync installed : sudo aptitude install rsync
#
# You need to run this script with the full path, ie. /usr/local/bin/tmrestore {arguments...} not ./tmrestore
#
# You need to run this script as root, running it in a real shell (not sudo script). Try "sudo su -" then invoke the script.
#
# Use tab completion to fill the arguments ie. /media/Time\ Machine\ Mount\ Point and not "/media/Time Machine Mount Point" (with double quotes). This must be also for the last argument if spaces are present.
#
# Exemple invocation :
#
# /usr/local/bin/tmrestore /media/Time\ Machine\ Mount\ Point/.HFS+\ Private\ Directory\ Data^M/ /TM\ Restore/My\ Files /media/Time\ Machine\ Mount\ Point/Backups.backupdb/iMac/Latest/Macintosh\ HD/Users/john/Desktop Desktop
#
# where :
# - /media/Time\ Machine\ Mount\ Point/.HFS+\ Private\ Directory\ Data^M/ is the path to the Time Machine hidden directory
# - /TM\ Restore/My\ Files is the path to where you want to restore your files/dirs
# - /media/Time\ Machine\ Mount\ Point/Backups.backupdb/iMac/Latest/Macintosh\ HD/Users/john/Desktop is the path in the Time Machine archive of the file/directory you want to restore
# - Desktop is the name of the directory that will be created in the path to where you want to restore your files/dirs
#
# THIS SCRIPT COMES WITH WARRANTY! (and is GPL)
#
# Feel free to improve it (adding comments, for exemple ;)
#---------------------------------------------------------

DEBUG=1

if [ $DEBUG -eq 1 ]
then
  echo ""
  echo "invoking $0 with arguments :"
  # note : if you copy/paste this code, you must replace ^M with the carriage return caracter. This is done, in vim, by, in edition mode (i), typing CtrlV, then the Enter key :
  HFS=`echo $1 | sed s/"^M"//g`
  DIR=`echo $3 | sed s/"^M"//g`
  echo "\$HFS : $HFS"
  echo "\$REST : $2"
  echo "\$DIR : $DIR"
  echo "\$DIRNAME : $4"
fi

IFS="
"
usage()
{
echo "Usage: `basename $0` [Path to .HFS hidden directory] [Path where to restore] [Path to directory to restore] [Name of the directory to restore]"
}

HFS="$1"
REST="$2"
DIR="$3"
DIRNAME="$4"
[ $# -ne 4 ] &! [ -d "$HFS" ] &[ "$REST" == "/" ] &[ "$REST" == "$HOME" ] &[ $DEBUG -eq 1 ] && echo ""

[ $DEBUG -eq 1 ] && echo "mkdir -p "$REST""
mkdir -p "$REST"

if [ -f "$DIR" ]
then
  INODE=`ls -l "$DIR" | cut -d " " -f2`
  SIZE=`ls -s "$DIR" | cut -d " " -f 1`
  if [ $INODE -gt 100 ] && [ $SIZE -eq 0 ]
   then
     [ $DEBUG -eq 1 ] && echo "$DIR is a specal TM dir, self invoking :"
     $0 "$HFS" "$REST/$DIRNAME" "$HFS/dir_$INODE" "`basename -- $DIR`"
     [ $? -ne 0 ] && exit 1
   else
     [ $DEBUG -eq 1 ] && echo rsync -avP -- "$DIR" "$REST"
     rsync -avP -- "$DIR" "$REST"
   fi
else
  cd "$DIR"
  for i in `ls -a .`
  do
    FILE="`basename -- "$i"`"
    [ "$FILE" == "." ] && continue
    [ "$FILE" == ".." ] && continue
    [ "$FILE" == ".DS_Store" ] && continue
    # please add file or dir you don't want to restore :
    [ "$FILE" == "backup dd externe" ] && continue
    [ "$FILE" == "Flash Player" ] && continue
    if [ -f "$FILE" ]
    then
      INODE=`ls -l "$FILE" | cut -d " " -f2`
      SIZE=`ls -s "$FILE" | cut -d " " -f 1`
      if [ $INODE -gt 100 ] && [ $SIZE -eq 0 ]
      then
        [ $DEBUG -eq 1 ] && echo "$FILE is a specal TM dir, self invoking :"
        $0 "$HFS" "$REST/$FILE" "$HFS/dir_$INODE" "$FILE"
        [ $? -ne 0 ] && exit 1
      else
        [ $DEBUG -eq 1 ] && echo rsync -avP -- "$FILE" "$REST"
        rsync -avP -- "$FILE" "$REST"
      fi
    else
      $0 "$HFS" "$REST/$FILE" "$DIR/$FILE" "$FILE"
      [ $? -ne 0 ] && exit 1
    fi
  done
fi

exit 0



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: kd8cyb on Jan 06, '11 01:38:30AM

Awesome script! Thank you very much. It worked perfectly except it keep repeatedly hanging on a corrupt file; I just had to hid Ctrl-C for it move on. Thanks again!



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: jeromemac75 on Jan 06, '11 10:55:02AM
Here is a new version (One or two bugs corrected) :

#!/bin/bash
#set -e
#
#---------------------------------------------------------
# Simple script to get files in an Apple Time Machine (TM) archive. Inspired by http://hints.macworld.com/article.php?story=20080623213342356
#
# Usage: /path/to/tmrestore <Path to .HFS hidden directory> <Path where to restore> <Path to directory to restore> <Name of the directory to restore>
#
# You need to have rsync installed : sudo aptitude install rsync
#
# You need to run this script with the full path, ie. /usr/local/bin/tmrestore {arguments...} not ./tmrestore
#
# You need to run this script as root, running it in a real shell (not sudo script). Try "sudo su -" then invoke the script.
#
# Use tab completion to fill the arguments ie. /media/Time\ Machine\ Mount\ Point and not "/media/Time Machine Mount Point" (with double quotes). This must be also for the last argument if spaces are present.
#
# Exemple invocation :
#
# /usr/local/bin/tmrestore /media/Time\ Machine\ Mount\ Point/.HFS+\ Private\ Directory\ Data^M/ /TM\ Restore/My\ Files /media/Time\ Machine\ Mount\ Point/Backups.backupdb/iMac/Latest/Macintosh\ HD/Users/john/Desktop Desktop
#
# where :
# - /media/Time\ Machine\ Mount\ Point/.HFS+\ Private\ Directory\ Data^M/ is the path to the Time Machine hidden directory
# - /TM\ Restore/My\ Files is the path to where you want to restore your files/dirs
# - /media/Time\ Machine\ Mount\ Point/Backups.backupdb/iMac/Latest/Macintosh\ HD/Users/john/Desktop is the path in the Time Machine archive of the file/directory you want to restore
# - Desktop is the name of the directory that will be created in the path to where you want to restore your files/dirs
#
# THIS SCRIPT COMES WITH NO WARRANTY! (and is GPL)
#
# Feel free to improve it (adding comments, for exemple ;)
#---------------------------------------------------------

DEBUG=1

if [ $DEBUG -eq 1 ]
then
  echo ""
  echo "invoking $0 with arguments :"
  # note : if you copy/paste this code, you must replace ^M with the carriage return caracter. This is done, in vim, by, in edition mode (i), typing CtrlV, then the Enter key :
  HFS=`echo $1 | sed s/"^M"//g`
  DIR=`echo $3 | sed s/"^M"//g`
  echo "\$HFS : $HFS"
  echo "\$REST : $2"
  echo "\$DIR : $DIR"
  echo "\$DIRNAME : $4"
fi

IFS="
"
usage()
{
  echo "Usage: `basename $0` <Path to .HFS hidden directory> <Path where to restore> <Path to directory to restore> <Name of the directory to restore>"
}

HFS="$1"
REST="$2"
DIR="$3"
DIRNAME="$4"
[ $# -ne 4 ] &! [ -d "$HFS" ] &[ "$REST" == "/" ] &[ "$REST" == "$HOME" ] &! [ -d "$DIR" ] && ! [ -f "$DIR" ] && exit 0

[ $DEBUG -eq 1 ] && echo ""
[ $DEBUG -eq 1 ] && echo "mkdir -p "$REST""
mkdir -p "$REST"

if [ -f "$DIR" ]
then
  INODE=`ls -l "$DIR" | cut -d " " -f2`
  SIZE=`ls -s "$DIR" | cut -d " " -f 1`
  if [ $INODE -gt 100 ] && [ $SIZE -eq 0 ]
   then
     [ $DEBUG -eq 1 ] && echo "$DIR is a special TM dir, self invoking (in 1):"
     $0 "$HFS" "$REST/$DIRNAME" "$HFS/dir_$INODE" "`basename -- $DIR`"
     [ $? -ne 0 ] && exit 1
   else
     [ $DEBUG -eq 1 ] && echo rsync -avP -- "$DIR" "$REST"
     rsync -avP -- "$DIR" "$REST"
   fi
else
  if [ -d "$DIR" ]
  then
    cd "$DIR"
    for i in `ls -a .`
    do
      FILE="`basename -- "$i"`"
      [ "$FILE" == "." ] && continue
      [ "$FILE" == ".." ] && continue
      [ "$FILE" == ".DS_Store" ] && continue
      # please add file or dir you don't want to restore :
      [ "$FILE" == "Flash Player" ] && continue
      [ "$FILE" == "iPhoto Library" ] && continue
      if [ -f "$FILE" ]
      then
        INODE=`ls -l "$FILE" | cut -d " " -f2`
        SIZE=`ls -s "$FILE" | cut -d " " -f 1`
        if [ $INODE -gt 100 ] && [ $SIZE -eq 0 ]
        then
          [ $DEBUG -eq 1 ] && echo "$FILE is a special TM dir, self invoking (in 2) :"
          $0 "$HFS" "$REST/$FILE" "$HFS/dir_$INODE" "$FILE"
          [ $? -ne 0 ] && exit 1
        else
          [ $DEBUG -eq 1 ] && echo rsync -avP -- "$FILE" "$REST"
          rsync -avP -- "$FILE" "$REST"
        fi
      else
        if [ -d "$FILE" ]
        then
        [ $DEBUG -eq 1 ] && echo "$FILE is a dir, self invoking (in 3):"
        $0 "$HFS" "$REST/$FILE" "$DIR/$FILE" "$FILE"
        [ $? -ne 0 ] && exit 1
      else
        echo "$FILE : Not a file, not a dir, maybe a link. Not treated (in 3)."
      fi
      fi
    done
  else
    echo "$DIR : Not a file, not a dir, maybe a link. Not treated (in 4)."
  fi
fi

exit 0
Edited on Jan 06, '11 11:07:39AM by jeromemac75


[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: kd8cyb on Jan 15, '11 01:32:42PM

I also noticed your old version went into infinite loops when it encountered symbolic links and also that it didn't copy files with special characters (like /, {, and } ). Does your new script correct this? Thanks



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: jeromemac75 on Jan 18, '11 10:45:41AM

the new version addresses the link problem. The characters are not treated as /, { or } are not valid characters for file names within Linux. Thanks for your interest :)



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: kd8cyb on Jan 18, '11 03:38:04PM

Yes, but OS X supports characters like /, {, and } in filenames; it just converts them to something like "\/", "\{}," etc. Your script didn't copy a filename that had a "/" in OS X.



[ Reply to This | # ]
How to access Time Machine files from Linux
Authored by: dathwinter on May 09, '13 02:14:28AM

I just read the original post and thought, hey this would make a great candidate for a script, then thought someone else must have thought the same thing. True enough. Great script! Thanks! :-)



[ Reply to This | # ]