Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.5: View exactly which files Time Machine backed up System 10.5
You may occasionally notice Time Machine is backing up an unexpectedly large amount of data, or maybe you're just curious as to what actually changed between backups. Perhaps you'd like to tailor your exclusion list to keep the backup size down. Unfortunately, the Time Machine interface provide no means to find out what it is actually being backed up. Luckily, we can use the fact that Time Machine creates hard links of unchanged files to explore what it did back up, after the fact. timedog is a Perl script (4KB download) which does just that. Use it like so:
$ cd /Volumes/TM/Backups.backupdb/myhost
$ timedog -d 5 -l
By default, timedog will examine the most recent backup, compare it to the one prior, and report all changed files. The -d flag controls the directory depth of reporting, -l disables reporting for symbolic links (for which Time Machine seems to create a new copy of the link each backup). You can also specify a backup of your choice as an argument, though it must also have one prior backup with which to compare.

This script should be safe, but standard warnings apply regarding mucking with your TM database.

[robg adds: I haven't tested this one; the script should already be marked as executable, so it should run after download without any changes.]
    •    
  • Currently 3.31 / 5
  You rated: 1 / 5 (13 votes cast)
 
[53,447 views]  

10.5: View exactly which files Time Machine backed up | 18 comments | Create New Account
Click here to return to the '10.5: View exactly which files Time Machine backed up' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
10.5: View exactly which files Time Machine backed up
Authored by: magir on Jul 17, '08 09:04:13AM
As an alternative you can use TimeTracker by the author of Pacifist. It's just a hack, so don't blame him, when it doesn't work. At least for me it works great, displaying recent backups along with the size of the backed up folders.

http://www.charlessoft.com/TimeTracker.zip


[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: nikster on Dec 06, '09 05:49:21PM

TimeTracker works fantastically well. No muss no fuss, just select the backup you want and it tells you how much space was used.

Helped me pin down MS Entourage as the reason every one of my backups was over 2GB in size... awesome!



[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: fracai on Jul 17, '08 11:03:38AM
Another alternative is tms which lets you treat the Time Machine backup as if it were a version control system like cvs.

---
i am jack's amusing sig file

[ Reply to This | # ]

10.5: View exactly which files Time Machine backed up
Authored by: clh on Jul 17, '08 05:35:07PM

I don't see Backups.backupdb in /Volumes/ProfGizmo/. Only thing there is a blah.sparseimage "file."



[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: jdsmith on Jul 21, '08 12:05:22PM

Sounds like a network drive (which is what I have as well). Mount the sparse image, and then operate inside of that mounted volume.



[ Reply to This | # ]
Enh Req: View exactly which files Time Machine backed up
Authored by: scottbayes on Jul 17, '08 09:03:22PM

This is functionality I've been looking for for quite a while now. Thank you!

One small request, since I'm not Perl-literate: please add a -n or some such option to format the output in a more machine-friendly format, as:

3126 3157 /Macintosh HD/Library/Preferences/SystemConfiguration/com.apple.network.identification.plist

(with nice wide fields like %15d or something, and maybe with TAB as field separator) instead of:

3.1KB-> 3.1KB /Macintosh HD/Library/Preferences/SystemConfiguration/com.apple.network.identification.plist

Would make it easier to pipe to sort(1) or cut(1) or load as csv into Excel, etc. I'd usually like to see my top N big updates.

I think the current format should remain the default, my suggestion is for geeks.



[ Reply to This | # ]
Enh Req: View exactly which files Time Machine backed up
Authored by: jdsmith on Jul 23, '08 09:19:25AM
Here's an update with -n and which reports the number of changed contents for summarized directories (with -d).

#!/usr/bin/perl
#
# timedog
#
#   J.D. Smith (jdtsmith A@T gmail _dot_ com)
#
# Display the files which time machine backed up in its most recent
# backup (or any of your choosing).  Uses the fact that Time Machine
# creates hard links for unchanged files and directories.  Reports old
# and new sizes of the changed files, along with the total file count
# and backup size.
#
# Usage:  timedog [-d depth] [-l] [-n] [latest]
#
#   N.B. You must first mount the time machine volume, and change to
#   the directory containing your time machine backup directories, the
#   ones named like 2008-07-14-112245/.  This can be found in the
#   directory /Volumes/TM/Backups.backupdb/hostname or similar.
#
#     latest: The backup directory for which you'd like to see the
#             changed contents.  Defaults to the most recent (the one
#             linked to by Latest)
#
#         -l: Omit symbolic links from the summary.  For whatever
#             reason, Time Machine creates a new version of a symbolic
#             link each and every time it backs up.
#
#         -n  Use simple fixed width formatting, and omit summaries.
#
#   -d depth: By default, all files are printed, which can get
#             lengthy.  With this option, summarize changes in
#             directories only down to the given depth.  The number of
#             files and subdirectories which changed will be reported
#             as [n].
#
# Example:
#   % cd /Volumes/TM/Backups.backupdb/myhost
#   % timedog -d 5 -l
#
###############################################################################
# 
# LICENSE
#
#  Copyright (C) 2008 J.D. Smith
#
#  This file is free software; you can redistribute it and/or modify
#  it under the terms of the GNU General Public License as published
#  by the Free Software Foundation; either version 2, or (at your
#  option) any later version.
#
#  This File is distributed in the hope that it will be useful, but
#  WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
#  General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this file; see the file COPYING.  If not, write to the
#  Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
#  Boston, MA 02110-1301, USA.
#
###############################################################################


use File::Find;
use Fcntl ':mode';
use Getopt::Std;

getopt('d');

sub bytes {
  my $bytes=shift;
  $format=shift || ".1";
  @suff=("B","KB","MB","GB","TB");
  for ($suff=shift @suff; $#suff>=0 and $bytes>=1000.; $suff=shift @suff) {
    $bytes/=1024.;
  }
  return int($bytes) . $suff if int($bytes)==$bytes;
  return sprintf("%${format}f",$bytes) . $suff;
}

sub summarize {
  ($size,$size_old,$old_exists,$name,$cnt)=@_;
  if ($opt_n) {
    printf "%12d %12d %s\n",$old_exists?$size_old:0,$size,$name;
  } else {
    if ($opt_d) { 
      printf "%9s->%9s %6s %s\n",$old_exists?bytes($size_old):"....  ",
	bytes($size),$cnt?"[$cnt]":"",$name;
    } else {
      printf "%9s->%9s %s\n",$old_exists?bytes($size_old):"....  ",
	bytes($size),$name;
    }
  }
}


opendir DIR,"." or die "Can't open directory.";
@files=sort grep {m|[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]+$|} readdir(DIR);
die "None or only one Time Machine backups found." if @files == 1;

if (@ARGV) {
  $latest=$ARGV[0];
  $latest=~s|/$||;
  foreach (@files) {
    last if $_ eq $latest;
    $last=$_;
  }
  die "Invalid backup directory" if !defined($last) || $last eq $latest;
} else {
  ($last,$latest)=@files[$#files-1..$#files];
}

print "==> Comparing TM backup $latest to $last\n" unless $opt_n;

my ($old_exists,$rold_exists,$rsize,$rsize_old);
$total_size=0;
$total_cnt=0;

find({wanted =>
      sub{
	($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size) =
	  lstat($_);
	($old=$_)=~s/^$latest/$last/;
	if (-e $old) {
	  ($dev, $ino_old,$mode_old,
	   $nlink,$uid,$gid,$rdev,$size_old) = lstat($old);
	  if ($ino == $ino_old) { # Prune matching
	    $File::Find::prune=1 if -d;
	    return
	  }
	  $old_exists=1;
	} else {$old_exists=0;}


	$total_size+=$size;

	$link=S_ISLNK($mode);
	return if $opt_l && $link;

	# Don't include links in the count
	$total_cnt++;
	($name=$_)=~s/^$latest//;

	if ($opt_d) {
	  $depth=$name=~tr|/||;
	  $rsize+=$size;
	  $rsize_old+=$size_old if $old_exists;
	  $rcnt++;
	  return if S_ISDIR($mode) || $depth > $opt_d; # Post will handle
	}
	$name.="/" if S_ISDIR($mode);
	$name.="@" if $link;
	summarize($size,$size_old,$old_exists,$name);
      },
      preprocess =>
      (!$opt_d)?0:
      sub{
	$depth=$File::Find::dir=~tr|/||;
	if ($depth<=$opt_d) {
	  # Starting a new printable directory; zero out sizes
	  $rsize=$rsize_old=$rcnt=0;
	  $rold_exists=-e $File::Find::dir;
	}
	@_;
      },
      postprocess =>
      (!$opt_d)?0:
      sub{
	$depth=$File::Find::dir=~tr|/||;
	return if $depth > $opt_d;
	# This directory is at or below the depth, summarize it
	($name=$File::Find::dir)=~s/^$latest//;
	summarize($rsize,$rsize_old,$rold_exists,$name.'/',$rcnt)
	  if $rsize || $rsize_old;
	$rsize=$rsize_old=$rcnt=0;
      },
      no_chdir => 1}, $latest);

print "==> Total Backup: $total_cnt changed files/directories, ",
  bytes($total_size,".2"),"\n" unless $opt_n;


[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: juanfal on Jul 18, '08 12:51:15AM

Is there some way of knowing which files will be backed up?? That is for me much more interesting than this.



[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: homeshire on Jul 18, '08 03:51:55AM

I can't get this to work for me. I'm sure it's because I know nothing about perl, so there is something I'm missing. I think terminal still launches for me with a tcsh shell, and this script may be for a bash shell. In any event, something's amiss whenever I try. Pity, I really want what this script offers.

Particularly frustrating in that the immediate comment after the hint says it is immediately executable without any changes.

But my purpose here is to say thanks for the tip on TimeTracker. I tried it, and in 30 seconds I had the long-sought answer to why my Time Machine has been saving gigs of data when I have done little to nothing since the previous backup. That's all I wanted, and I got it here in this tip, if indireclty.



[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: jdsmith on Jul 21, '08 12:06:53PM

See the comment below: good summary for non-terminal types.



[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: V.K. on Jul 18, '08 02:34:40PM
very nice but instructions for non terminal savvy people are in order. the first command should be
cd "/Volumes/TM-drive-name/Backups.backupdb/myhost"
instead of TM-drive-name put the name of your TM drive. instead of myhost put the name of your computer. It can be found in system preferences->sharing. In the second command you need to specify the full path to unix executable timedog. if after you unzip the download you put it on your desktop the command would be
~/Desktop/timedog -d 5 -l

[ Reply to This | # ]
Filter by size
Authored by: SeanAhern on Jan 22, '09 12:33:27PM

I made a modification to allow you to filter by size, letting you filter out tiny file changes. This lets me easily see what are the big changes that are eating up my drive.



[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: jdsmith on Jan 23, '09 03:50:45PM
Timedog has a new home on Google Code.

Check there for the latest versions.

[ Reply to This | # ]

10.5: View exactly which files Time Machine backed up
Authored by: palahala on Jul 10, '09 04:35:18AM

Note that, even when running as an admin user, sometimes timedog and TimeTracker need to be run as root to see all files. When not doing that, one might for example not take the backups of MySQL logs and data into account:

cd "/Volumes/Backup of Palahala/Backups.backupdb/Palahala/Latest"
sudo ls -l "Macintosh HD/usr/local/mysql-5.0.51a-osx10.5-x86"
[..]
drwxr-x---@  6 _mysql  wheel    374 Jul  2 20:05 data

In those cases both timedog and TimeTracker will report a lower total backup size and less files than the backupd logs in Console (easily shown using the Time Machine Buddy widget), or the (different) log that is kept in the hidden .Backup.log file on the backup disk.

So, for timedog:

cd "/Volumes/Backup of Palahala/Backups.backupdb/Palahala" 
sudo ~/Downloads/timedog

Likewise, for TimeTracker:

sudo TimeTracker.app/Contents/MacOS/TimeTracker

[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: palahala on Jul 16, '09 03:46:17PM

As BlaatMekker also referred to this hint in 10.5: One possible cause of huge Time Machine backups, let's mention yet another tool to find large files on your disk: Disk Inventory X.

This program has nothing to do with Time Machine, but may help investigating problems, like when you wonder why your backup is a lot smaller than the space used on your hard disk. Note that this program will probably always report less total disk space in its window title than in its screen where one can select which disk to investigate (even when running as root and choosing menu View, Show Physical File Size). But if the reported total size is really a lot smaller than the actual totals used on your Mac, then it may help to run as root:

sudo "/Applications/Utilities/Disk Inventory X.app/Contents/MacOS/Disk Inventory X"


[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: nick_harambee on Aug 17, '09 08:30:52AM

hi

could someone please tell me how to specify which backup to load/compare using timedog, i.e. i would like to analyse specific backups rather than just the last one

thanks

nick



[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: nikster on Dec 06, '09 05:50:41PM

As pointed out above, TimeTracker works really well (see first comment).

Don't need to bother with the command line.



[ Reply to This | # ]
10.5: View exactly which files Time Machine backed up
Authored by: DeepYogurt on Mar 27, '13 07:09:39PM

I'm running this "timedog" command (the one with the new code to enable the "-n" switch listed above by JDSmith on Jul 23, 2008) on Mountain Lion and noticed something that makes no sense. When run it says at the end that "3510 changed files/directories" but if I use the "wc" command on the output it says that it contains only 793 lines. Shouldn't there be 3510 + 2 lines in the file (2 extra lines are the line at the start saying which folders are being compared and the line at the end that gives the totals), since each file or folder that is different is supposed to be listed? Why such a big difference in what it says are different and what it lists as different?

Thanks...

-Bob



[ Reply to This | # ]