GrandPerspective icon

How to analyse Time Machine back-ups

GrandPerspective can be used to analyse back-ups made by Time Machine. This can help you to optimise your Time Machine back-up scheme, for example, by identifying files and folders that should not be backed up.

First of all, it is important to understand how Time Machine back-ups are stored. Time Machine makes extensive use of hard links. Each back-up appears to store a copy of the entire drive that is backed up. Yet the amount of disk space needed for a back-up is limited the files that have changed since the preceding back-up. All files and folders that have not changed, are represented by hard links to these items in the preceding back-up.

Below are some ways in which you can use GrandPerspective to analyse your Time Machine back-up. They are simply meant to give you an idea of what you can do. You are of course free to experiment with other approaches.

Comparing back-ups

You compare two back-ups to see what has changed on your hard drive. Doing so is very straightforward. First, you execute Scan Folder on an old back-up, e.g. "Backup Volume/Backups.backupdb/My Computer/2008-08-08-888888". Next, you can scan in the contents of the latest back-up, i.e. "Backup Volume/Backups.backupdb/My Computer/Latest". Having both views open alongside each other will hopefully let you quickly spot the biggest differences.

Note: Instead of scanning in the latest back-up you can scan in the current contents of your hard drive. The drawback of the latter approach is that the resulting view will include files that are excluded from Time Machine back-ups, which will make it more difficult to spot actual changes.

Scanning all back-ups

Execute Scan Folder on the folder "Backup Volume/Backups.backupdb/My Computer". This may take a while. When scanning is complete, a view is shown showing all back-ups. In the Display panel, select coloring by "Top folder". All files belonging to the same back-up now have the same color.

You will probably see that one back-up is much larger than the rest. This is likely the earliest back-up folder. The back-ups are scanned in the order they have been created. So the folder containing the earliest back-up is scanned first. All files in it are encountered for the first time and are therefore included. When scanning the other back-up folders, most hard-linked files will have been encountered already (in older back-ups) and so are now exluded.

The folder that was scanned first is actually the least interesting. It simply shows the contents of your hard-drive at the time of the scan (minus the files that you have chosen to exclude from your Time Machine back-ups). So let's exclude it from the view. Start by creating a new filter. You need to create a new filter test. Name it "Main back-up", apply it to "files and folders", and let it include the Path sub-test, matching paths that start with "/Volumes/Backup Volume/Backups.backupdb/My Computer/2008-08-08-888888". The parts in italics will be different in your case. You can get the path string you need from the Focus panel. First in the view select any file from the largest back-up folder, zoom in one level, copy the path from the "Folder in view" text box, and zoom out again.

Add the newly created "Main back-up" test to your new filter. The test will automatically be inverted (as it should). After having created the filter, you can select it as a mask from the Display panel. You should see that the main back-up is now masked. If this is not the case, you did not specify the filter correctly. Edit it again until it works.

When the mask works correctly, you should filter the view. Use the Filter command. It should by default be configured the same as the mask, so simply click "OK". A new view window is created, only showing the other back-ups. This new view gives a much better idea of the size required by each incremental back-up. Navigate and explore this view to get a better idea of what is backed up. If you spot files that should not be backed up, update your Time Machine preferences.

Check which files have been backed up during the latest back-up

Initiate a Filtered Scan. As the folder to scan, pick "Backup Volume/Backups.backupdb/My Computer/Latest". Apply the "No hard-links" default filter. The result is a view showing the files that are new in the latest back-up. The view excludes all files that appeared in earlier back-ups.

Note: You can apply the same filter to other back-up folders. However, you should then interpret the data in the view differently. In this case, each file that is shown does not appear in earlier back-ups and the contents of the folder that the file appears in has not changed in later back-ups for as long as the file has existed (unchanged). Indeed, that's a bit harder to get your head around, and slightly less useful as a result.