How to analyse Time Machine back-ups
Description: How to analyse Time Machine back-ups.
Keywords: how to, Time Machine, back-up, back up, hard link, analyzing back-ups

# How to analyse Time Machine back-ups (on HFS+ volumes)

GrandPerspective can be used to analyse back-ups made by Time Machine. This can help you to optimise your Time Machine back-up scheme, for example, by identifying files and folders that should not be backed up.

It is important to understand how Time Machine back-ups are stored. Each back-up appears to store a copy of the entire drive that is backed up. Yet the amount of disk space needed for a back-up is limited by the files that have changed since the preceding back-up. Files and folders that have not changed are not duplicated but shared between back-ups. On HFS+ volumes Time Machine uses hard links for this. On AFPS volumes Time Machine shares common content at the lower, file-block layer. Re-use via hard links is visible to GrandPerspective, but re-use at the file-block layer not. Some of the suggestions on this page therefore only apply when back-ups are stored on an HFS+ volume.

Below are some ways in which you can use GrandPerspective to analyse your Time Machine back-up. They are simply meant to give you an idea of what you can do. You are of course free to experiment with other approaches.

## Comparing back-ups

You can compare two back-ups to see what has changed on your hard drive. Doing so is very straightforward. First, you execute Scan Folder on an old back-up, e.g. "Backup Volume/Backups.backupdb/My Computer/2008-08-08-888888". Next, you can scan in the contents of the latest back-up, i.e. "Backup Volume/Backups.backupdb/My Computer/Latest". Having both views open alongside each other will hopefully let you quickly spot the biggest differences.

Note: Instead of scanning in the latest back-up you can scan in the current contents of your hard drive. The drawback of the latter approach is that the resulting view will include files that are excluded from Time Machine back-ups, which will make it more difficult to spot actual changes.

## Scanning all back-ups

Execute Scan Folder on the folder "Backup Volume/Backups.backupdb/My Computer". Be warned, this may take a while. When scanning is complete, a view is shown showing all back-ups. In the Display tab, select coloring by "Top folder". All files belonging to the same back-up now have the same color. Alternatively, you can color files by creation date using a heatmap palette. Recent files are shown in red, old files in blue.

Several years of Time Machine back-ups. Together they contain four million files in one million folders. Files are colored by their creation date.

## Analyzing all back-ups (HFS+ volumes only)

After scanning all back-ups you will probably see that one back-up is much larger than the rest. This is likely the earliest back-up folder. The back-ups are scanned in the order they have been created [footnote 1]. So the folder containing the earliest back-up is scanned first. All files in it are encountered for the first time and are therefore included. When scanning the other back-up folders, most hard-linked files will have been encountered already (in older back-ups) and so are now excluded.

The folder that was scanned first is actually the least interesting. It simply shows the contents of your hard-drive at the time of the scan (minus the files that you have chosen to exclude from your Time Machine back-ups). So let's exclude it from the view. Start by creating a new filter. You need to create a new filter test. Name it "Main back-up", apply it to "files and folders", and let it include the Path sub-test, matching paths that start with "/Volumes/Backup Volume/Backups.backupdb/My Computer/2008-08-08-888888". The parts in italics will be different in your case. You can get the path string you need from the Focus tab. First in the view select any file from the largest back-up folder, zoom in one level, copy the path from the "Folder in view" text box, and zoom out again.

Add the newly created "Main back-up" test to your new filter. The test will automatically be inverted (as it should). After having created the filter, you can select it as a mask from the Display tab. You should see that the main back-up is now masked. If this is not the case, you did not specify the filter correctly. Edit it again until it works.

When the mask works correctly, you should filter the view. Use the Filter command. It should by default be configured the same as the mask, so simply click "OK". A new view window is created, only showing the other back-ups. This new view gives a much better idea of the size required by each incremental back-up. Navigate and explore this view to get a better idea of what is backed up. If you spot files that should not be backed up, update your Time Machine preferences.

Footnote 1: From GrandPerspective 2.0 onwards, the application does not explicitly specify the scan order anymore. The order is now determined by the directory scanner provided by Cocoa Framework. On my system, this still scans the oldest back-ups first. However, there is no guarantee that this happens on every system nor that this behaviour will not change after a future update of macOS. If the scanning order changes then the back-up folder in which a hard-linked file appears may change.

## Check which files have been backed up during the latest back-up (HFS+ volumes only)

Initiate a Filtered Scan. As the folder to scan, pick "Backup Volume/Backups.backupdb/My Computer/Latest". Apply the "No hard-links" default filter. The result is a view showing the files that are new in the latest back-up. The view excludes all files that appeared in earlier back-ups.

Note: You can apply the same filter to other back-up folders. However, you should then interpret the data in the view differently. In this case, each file that is shown does not appear in earlier back-ups and the contents of the folder that the file appears in has not changed in later back-ups for as long as the file has existed (unchanged). Indeed, that's a bit harder to get your head around, and slightly less useful as a result.