Time Machine Information

Time Machine is an backup package, that was first introduced in Mac OS X 10.5 (Leopard).  While the backup software is included, it relies on a secondary hard drive to act as the repository for the backup.  The backup drive and the backed up drives have to be Mac OS Extended Journaled (HFS+) format.

Time Machine works, by making an Master Snapshot of the computer, and then periodically recording any differences/deltas between the last snapshot, and the current state of the hard drive.  Time Machine currently supports the following backup storage

Time Machine currently supports the following backup devices:

An external disk (USB or FireWire)

A secondary partition  (Personally not recommended!)

A secondary internal disk

A Time Capsule

An external disk (USB or Firewire) attached to another Mac running Leopard or Snow Leopard on the same local network

An available Mac OS X Server version 10.5 or 10.6 volume

Airport Extreme w/Connected external Media

How this differs from Retrospect, or other packages, is as follows:

• The differences are recorded as incremental backups, not as an Differential.  The difference is that with an incremental the actual file is “backed” up in each time it is modified to the backup drive, thus simplifying the issue for restoration.  With a differential backup, only the changes between each revision of the file is backed up.  That means that the backup software would have to restore the original file, and then apply each differential backup, until all the differentials have been processed. This is effectively merging multiple copies of the file, a potential complex process.  With the incremental Time Machine only needs to find the latest copy, and copy it to the destination.
• All files, and directories that do not change, are actually hard links to previous snapshot of the directory or file.  This allows the backups to be complete without having to duplicate files, or directories.  Literally only the files that have changed are recorded during the backup.  The rest of the backup image, are links to previous backups.
• The user can manually locate a backup on the Time Machine backup, without using the GUI Time Machine tools, and drag the files (or folder) that they wish to recover, back to a different drive.  The restore process is just simply copying to files from the Time Machine backup drive.  This is allows you to perform restores from Single User Mode, or a command shell, for disaster recovery.
• To some extent Time Machine relies on Spotlight.  It’s known that Spotlight and Time Machine both rely on the same basic File Change tracking mechanism (fsevents), but Spotless (3rd party Spotlight disabling package) has supposedly been known to also turn off/disable Time Machine.
• I am currently recommending to folks, to use the following exclusions on Time Machine.  (See Below)

The scope of Time Machine (Time Machine Exclusions)

Time Machine, by default, backups up every local drive on your machine.  It won’t backup network mounted drives, but any local drive that is not excluded is by default added into the backup.  Apple has a standard list of exclusions, but since Apple has not officially documented these exculsions they may change unpredictably in the future.  But for now, the following directories do not have to be excluded manually:

• • /.Spotlight-V100
  • /private/var/db/Spotlight <!– old tiger location of the Spotlight db –>
  • /private/var/db/Spotlight-V100     <!– old tiger location of the Spotlight db –>
  • /.Trashes
  • /.fseventsd
  • /.hotfiles.btree
  • /Backups.backupdb
  • /Desktop DB
  • /Desktop DF
  • /Previous Systems
  • /Users/Shared/SC Info
  • /Users/Guest
  • /dev,  /home,  /net
  • /Volumes
  • /Network
  • /automount
  • /.vol
  • /tmp
  • /cores
  • /private/tmp
  • /private/Network
  • /private/tftpboot
  • /private/var/automount
  • /private/var/folders
  • /private/var/run
  • /private/var/tmp
  • /private/var/vm
  • /private/var/db/dhcpclient
  • /private/var/db/fseventsd
  • /Library/Caches
  • /Library/Logs
  • /System/Library/Caches
  • /System/Library/Extensions/Caches
  • /private/var/log
  • /private/var/spool/cups
  • /private/var/spool/fax
  • /private/var/spool/uucp
  • ~/Library/Application Support/SyncServices/data.version
  • ~/Library/Caches
  • ~/Library/Logs
  • ~/Library/Mail/Envelope Index
  • ~/Library/Mail/AvailableFeeds
  • ~/Library/Mirrors
  • ~/Library/PubSub/Database
  • ~/Library/PubSub/Downloads
  • ~/Library/PubSub/Feeds
  • ~/Library/Safari/Icons.db
  • ~/Library/Safari/WebpageIcons.db
  • ~/Library/Safari/HistoryIndex.sk

The exclusions below are based on what works for us at my work place, where the IT department is not responsible for the contents of the ~/Music, and ~/Movies folder.  (The thunderbird exclusion is due to the monolithic nature of the database, it could rapidly consume your Time Machine free disk space…)  I believe excluding Podcasts, and Music Downloads is reasonable, since that will be rebuilt when restored, the user can just redownload the podcasts.

Remember, any exclusions mean the potential for data loss… Because of this, I encourage people to consider what they are excluding….  And to be sensible about their acceptable risk levels.

The very basic exclusions that I use at home, are the following:

• • ~/Music/iTunes/”iTunes Music”/Podcasts
  • ~/Music/iTunes/”iTunes Music”/Downloads
  • ~/DropBox
  • /”System Folder (from old Mac)”
  • /”Applications (Mac OS 9)”
  • /”Applications (from old Mac)”
  • If you use, Thunderbird, consider adding your Thunderbird Mail Database.  Due to it’s design, all of Thunderbird’s mail is stored in a database.  This database will change everytime a email is received, or sent, and thus everytime Time Machine runs, it will back this database up again.  I would recommend excluding it, and once a month make a copy of the database, and have that copy backed up…
  • Please note:  File Vault users need to ensure that their user folder is excluded, when using Time Machine.  If they do not, they will be backing up their user folder twice.  Once from the virtual home directory, and once from the Sparse Bundle image file, when logged out.  Normally this is automatically added, but if you clear your exclusions, you may have removed this exclusion.

Download the basic shell script here: TimeMachine-exclusions-v1_3-Basic Version - v1.3, Downloaded - 43 times  Please note, these script will erase all your old exclusions, and replace them with the default set from the script.

In addition to the basic exclusions, I have an “aggressive” list, which includes the following:

• • /Developer
  • /System
  • /Library/Audio
  • /Library/Printers
  • ~/Music
  • ~/Movies
  • /Applications
  • /Applications (from old Mac)
  • /Users/Shared/Infected
  • Please note:  File Vault users need to ensure that their user folder is excluded, when using Time Machine.  If they do not, they will be backing up their user folder twice.  Once from the virtual home directory, and once from the Sparse Bundle image file, when logged out.  Normally this is automatically added, but if you clear your exclusions, you may have removed this exclusion.

The ~/Music directory normally contains your iTunes data, if you do exclude that directory, please ensure to backup your iTunes files in some other manner.

The reason for this aggressive nature is that at Work, the policy is that the computers are for work…  The users are not prohibited from have non-work content, but we do not backup their non-work content…  Thus the exclusions for ~/Music,  and ~/Movies…

Download the Shell script, here:  TimeMachine-exclusions-v1_3-Aggressive Version - v1.3, Downloaded - 45 times  The aggressive script will append these entries to your existing exclusions.

The downside to excluding the System files

Why should or shouldn’t you exclude the system files?  Well, the advantage is that you’ll save a tremendous amount of space on your Time Machine drive, but the disadvantage is that if you want to do a full system restore, you’ll need to re-install from a DVD (or other media), and then choose to restore from a Time Machine backup when offered.

Excluding the system files does not prevent your preferences from being backed up, so you should not have to reconfigure your applications, but you would need to run Software update to ensure that the latest patches were re-applied.

Remove backups

You can remove files from backups by viewing the enclosing folder in the Finder, then enter Time Machine. Find the file or folder, right/control-click and choose either delete that backup, or delete all backups (versions) of the file.  Once you identify any files as ones you don’t want a bunch of back-ups of:

1. connect your time machine backup drive
2. click on the time machine logo in the menu bar
3. select “Enter Time Machine”
4. navigate to and select those files/folders in the Time Machine window
5. click on the gear menu icon
6. select “Delete all backups of” ….  Time Machine will prompt for your password and delete all of the backups of the file/folder. You can then exclude these files/folders from future backups. To do so:
   1. go to the Time Machine preference pane in the System Preferences
   2. click “Options…”
   3. add the file/folder you wish to exclude from future backups

Suggested best practices

• Where possible, use a local hard drive for your Time Machine Backup.  While Time Capsules, & other network based drives can be used, the speed difference, and reliablity differences are impressive.  Network backups can be used, but your life will be significantly more comfortable if you use local storage instead.
• Upgrade to Snow Leopard (10.6.1) if possible.  It fixes two significant bugs, and is much faster and more reliable than Leopard (10.5.8).  But I still stand by the suggestion to use local disk storage where possible.
• Have as few exclusions as possible, to help reduce the chance of data loss.

Potential Issues with Time Machine

• Time Machine, can incrementally backup a File Vault (created under 10.5x), but it requires the user to be logged out (at the login window).
  • File Vault users do not get a “transparent” time machine backup every hour of the day. The only time the Time Machine backup occurs when the user is logged out & the Time Machine drive attached. Most users do not leave there systems logged out for any significant length of time. This requires the user to be accept downtime, while the system backups up.
  • File Vault users have to manually restore file through the file system. The “Galaxy” user interface is not available.
• Time Machine does not backup the Entourage database, if Entourage is running. Entourage somehow prevents Time Machine from backing up the database, if Entourage is running.
  • To force a backup, Quit Entourage, My Day, and any other MS product. Go to Time Machine, and choose Backup now.
• Thunderbird Also uses a monolithic mail database, so exclude your Thunderbird mail directory
• If the Free Space Allocation table is damaged, Time Machine can become “stuck” at the Preparing phase and never finish preparing.  Eventually the system will eventually lock up (system is still responsive, but drive related function may not occur in a timely manner, eg can’t log out, reboot, restart, or start an application).
• The technical reason why Apple limits Time Machine to 10.5+ AFP volumes appears to be to prevent disk image corruption. There were additional features added to AFP in 10.5 to support Time Machine. These presumably allow the disk image engine to force disk image journal data to write out all the way to the disk. Without such features, a network interruption can result in a corrupted filesystem on the disk image despite journaling. Remember, journaling relies on the journal being written all the way to disk before the changes take place. If you can’t guarantee that (e.g., because of network/NAS buffering) then the journal is useless. Time Machine appears to rely heavily on disk journaling to deal with network drop-outs, interrupted backups, and the like. Take this away and your data is at risk.If the NAS you are using supports these features it should report them to the OS and you should natively be able to choose that volume. If you have to trick the OS to use the volume it means the NAS does not support it.To summarize: if you care about your backup data you should avoid using non-natively supported AFP servers.  (There is a less-than-satisfactory work-around: backup to a Mac, then use rsync to copy the disk image to the NAS manually. This is what I do to have an off-site copy of my backup.)
• This MacOSXHints article walks through the setup of a non-support disk with Time Machine.
• Disk Warrior v4.1x and higher can safely repair a Time Machine Drive (Leopard & Snow Leopard)
• Tech Tool Pro v4.61 & higher (including 5) can safely repair a Time Machine Drive (Leopard & Snow Leopard).  Due to the number of hard and soft links on Time Machine volumes, Tech Tool Pro may need to be run from a bootable drive, instead of the bootable DVD.  When booted from the bootable DVD, virtual memory is not available to the Operating system.  (tech note)
• Will time machine backup the system if you are not logged in?  Yes and No.  The only time that Time Machine will back up the system when you are logged out, is that you are using File Vault.  Otherwise, no Time Machine will not backup your system without a user being logged in, unless you hack the system.  This setting should allow the backup:   sudo defaults write /Library/Preferences/SystemConfiguration/autodiskmount AutomountDisksWithoutUserLogin -bool true  (See MacOSXHints for more details.)
• (Obvious but…) In theory Mac OS X 10.4 can use read Time Machine Backups, but when navigating the backups.backup directory, when entering a directory linked by hard link, the directory name will be displayed improperly.  The data will be fine, but it will be confusing to navigate the directory structure.  Try to ensure using a 10.5 or 10.6 system for any restores.  This became evident when a 10.5 system died, and we had to use a 10.4 system for restoring the files temporarily…
• Time Machine is very boolean in it’s operation.  It either was successful or failed.  So if there is a single file that it can’t backup, it aborts it’s current backup, and shuts down until the next backup cycle.  Non-optimal.  Other backup software will log an error on a particular file, but continue with the current backup cycle, until done.  Time Machine does not have any built-in mechanism to verify a set of backups as being valid. That’s one issue with Time Machine, being consumer orientated instead of enterprise…Performing a Disk Repair in Disk Utility doesn’t validate the Time Machine backup data, but will verify the structure and integrity of the backup disk. (Of course, Disk Warrior verifies / repairs in a complementary manner).The only way that I see that you could verify the data in the backup is to do a full restore.

Please note, you can open the Console logs, and filter against BACKUPD to see what happens during a backup, and see if any error conditions occurred.

Time Machine Logging

Time Machine logs information to two different places.  First, check the Console Logs, specifically “All Messages” for any items marked from com.apple.backupd (Backup Daemon).  The other log file is stored in the actual Time Machine backup directory, for example,Backups.backupdb/nerv/Latest or Backups.backupdb/nerv/2009-12-13-034918. If you use the backup logfile, the file name is .Backup.log, which is a hidden file, and you will need to have authorization to open the file.  It’s significantly more detailed then the console log.

Time Machine Error Messages

Here’s what some common messages mean:

• Event store UUIDs don’t match naming (Hard drive name)
  • TM can’t be sure the OSX internal log of file changes that it normally uses is correct. This is normal on your first backup. Otherwise, it’s usually caused by an improper shutdown, a full restore, certain hardware repairs, removal of certain exclusions, a large volume of changes (including an OSX update), or many days without a successful backup. It may cause a lengthy backup, so if you see it frequently, without a good reason, you need to figure out why.
• Event store UUIDs don’t match naming (Hard drive/partition name)
  • TM isn’t sure that everything on it is what TM expects. This may be because the drive was disconnected improperly, or it doesn’t appear to be the drive TM expects. This is normal for the first backup to an empty disk/partition, but if you see this without a good reason, investigate.
• . . . node requires deep traversal
  • Instead of the log of file changes TM normally uses, it must examine every file and folder on the named drive/partition and compare it to your backups to be sure what’s changed and needs to be backed-up. Obviously, this is a lengthy procedure. You may not see any more messages for quite a while. This may be especially lengthy if you’re doing wireless backups. Note that while this is in progress, you’ll see “Preparing”.
• Backup content size: xxx MB/GB excluded items size: yyy MB/GB for volume zzz
  • These sizes are rough estimates (and sometimes quite far off).
• . . . xxx MB/GB requested (including padding), yyy MB/GB available
  • The amount requested is more, usually about 20% more, than the total of the Backup content sizes listed, as TM needs extra free workspace on the TM drive/partition.
• No pre-backup thinning needed. – TM has room for the new backup.
• Starting pre-backup thinning usually followed by:
  • No expired backups exist – deleting oldest backups to make room and a list of deleted backups - These are weekly backups that TM must delete to make room for the new backup.
  • No post-backup thinning needed. There are no expired backups.
  • Starting post-backup thinning, followed by a list of deleted backups - These backups are either hourly backups over 24 hours old, or daily backups over a month old.

• Backup failed with error: 11
  • I haven’t seen Error 11’s in a while, so this may have been resolved in a 10.5.x update, or Snow Leopard.
  • This appears to be a error when building the current backup, or a failure in clean up of a prior backup, so it is a fairly generic error.
  • Before formatting or performing exotic repairs, try changing your USB or Firewire cable.  It could be a marginal or defective cable.
  • The solution appears to be to delete the *date*.inProgress file.  See this blog entry for locally attached drives.
  • For network based Time Machine backups, please take a look at this MacOSXHints entry.
• Indexing a file failed. Returned -12 for *filename*
  • Try rebuilding your spotlight cache for the drive that *filename* is located on.
• Waiting for index to be ready (100), Waiting for index to be ready (101), Indexer unavailable (200)
  • Use Disk Utility and/or Disk Warrior to examine the hard drive, and ensure everything is fine with the underlying structure.
  • There maybe a communications issue with the external drive, this has been seen if the bandwidth to the drive goes too low (network), or if there is an USB/Firewire issue on the bus.
• You do not have appropriate access privileges to save file “.<nnnnnnn>” in folder <name of TM Drive>
  • A temporary file was not cleaned up properly during a backup, and is preventing Time Machine from continuing.
  • At the prompt, type the following exactly as shown in the example, substituting the name of your TM drive exactly, including any spaces, between the quotes; and the string of numbers & letters from the message where the series of x’s are (keep the dot):
    

            sudo chmod 644 /volumes/"TM drive name"/.xxxxxxxxxxxx

    example: sudo chmod 644 /volumes/"TM Backups"/.0a1b2c3d4e5f

    Press Return. You’ll get some warnings and a request for your Administrator’s password. Type it in (it won’t be displayed) and press Return again.

    Then try a Back Up Now from the TM icon in your Menubar, or by right-clicking the TM icon in your dock.

• The Backup Volume is Read Only.
  • Run Disk Utility or Disk Warrior on the Time Machine Volume.
  • If this is a Airport disk, then ensure that the Airport Utility has the drive marked as Read/Write, not as a Read Only Volume.
• With Snow Leopard, there have been some reports of Time Machine being stuck in a cycle where it only backs up 93 bytes…  This maybe triggered by doing a live verification of the disk (not a disk permissions repair) in disk utility.  The suspicion is that a process is being temporarily turned off, but may not be restarting after the verification (fsevents?).  A reboot of the system seems to solve this problem.

Time Machine Workarounds

• Removing Obsolete disks from Time Machine – How can you remove the contents of a disk that is no longer connected to your system from your Time Machine Backup?  The solution is to navigate in the Time Machine interface not to the disk itself, but to the backup entry for that disk on the Time Machine disk itself. Specifically, in Time Machine’s Finder view, select the Time Machine disk, then enter the Backups.backupdb folder, and drill down to find the last entry for the obsolete disk. Then tell Time Machine to delete all backups of that entry. The original disk need not be connected!   If you think about this, it’s an unexpected behavior since it’s outside the standard paradigm of pointing to the “real file” you want to remove the backups of.
• Compressing Sparse Image files.  Use the following Command line:

  hdiutil compact image.sparsebundle

  This will, as explained in the man page, only reclaims completely unused band files.

• Normally to remove a file or folder from Time Machine, you would open Time Machine, highlight the file or folder, and then choose Remove from Backup in the options pull down.

  But to do this with an invisible directory in the Finder by using Go -> Go to Folder… (command-shift-G) and enter the path. Once it’s showing, Enter Time Machine and follow the steps here.

  Note: you can delete the folder you’re looking at (instead of a file/folder within it) by righ/control-clicking in the Finder window in Time Machine and selecting the Delete All… option with its name there.

• One of the features we were most looking forward to was the ability to set Time Machine to use a NAS volume.
  defaults write com.apple.systempreferences TMShowUnsupportedNetworkVolumes 1
  and you should be able to select NAS volumes in the Time Machine prefs. Of course, you should only re- enable carefully since Apple has it’s reasons for restricting Time Machine volumes to the Airport line of products.  See the Potential issues for details.
• Verification of an Backup. In the end, a Time Machine backup is a collection of folders for each backup date. Each of those folders holds all files that existed on that date. So, you can compare the names and contents of all those files with those on your Mac.Of course, many files will change by simply using your Mac. So the results take some common sense to interpret. The best option is to close all running applications, run Time Machine, and then compare right away.  After you have connected your backup disk, use the following in Terminal to find the differences. For the cd command below you might want to use Tab command line completion rather than just pasting the first line:

  cd /Volumes/Backup*/Backups.backupdb/*/Latest/*/
  echo “Current folder on backup disk: $(pwd -P)”
  sudo diff -qr . / 2>&1 | tee $HOME/timemachine-diff.log

  This will compare the current folder (being the latest backup) with the root of your Mac. It shows the results on the screen, but also captures these in the file timemachine-diff.log in your home folder.  The above will run a VERY long time (hours, maybe even days), so for testing you can first limit to a specific folder. Like for your desktop:

  cd /Volumes/Backup*/Backups.backupdb/*/Latest/*/$HOME/Desktop
  echo “Current folder on backup disk: $(pwd -P)”
  sudo diff -qr . $HOME/Desktop 2>&1 | tee $HOME/timemachine-diff.log

  If there’s no output, then there are no differences. For testing just rename a file on your desktop, which should give you both “Only in .” for the original name (which is only on your backup) and “Only in /Users/username/Desktop” for the new name (which is not in the backup).

System Preference Overrides…

• Turn On - defaults write /Library/Preferences/com.apple.timemachine AutoBackup -boolean true
• Turn Off - defaults write /Library/Preferences/com.apple.timemachine AutoBackup -boolean false

Manually starting a Time Machine Backup from the Terminal

• /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper -auto

Time Machine Aware Software

• Finder
• Apple Mail
• Address Book
• iLife 2008 (iPhoto 2008, Garage Band 2008, iMovie 2008, iWeb 2008)
• Grand Perspective
• Plus Many More

Time Machine Resources

• Ars Technica – Leopard review - http://arstechnica.com/apple/reviews/2007/10/mac-os-x-10-5.ars/14
• Ars Technica – Deborking Mac w/TM - http://arstechnica.com/apple/news/2009/01/time-machine-lessons-deborking-your-mac.ars

Time Machine Diagnostic Software

• Grand Perspective
• Time Machine Buddy
• Time Machine Reporter (My own package)
• Time Machine Editor
• TM Error Logger
• TimeCopy Differences script Perl Version - 2, Downloaded - 16 times, Time Machine Differences script originally found here.  I Mirrored it, incase it is taken down….
• Time Dog
• Back in Time
• Time Tracker - TimeTracker is a quick-and-dirty application that displays the contents of your Time Machine backups, and shows what’s changed since the previous backup.   From Charlesoft..
• Time Tamer - Don’t want Time Machine to fill up your whole Drobo? This application for OS X based upon an Automator action provides a simple way when you’re setting up Time Machine to force it to only use up 2x the size of your internal hard drive for backup on your external hard drive. Please note, as with all DroboApps, this is unsupported by either Apple or Data Robotics so please use at your own risk.

Recommended Hard Drives for Time Machine Use

• I currently use the earlier version of the MyBook Studio 1 TB drive, with no issues, and the Firewire 800 connection speed makes Time Machine fly…  At $155, that’s pennies per Gb..