Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the best-selling Take Control ebooks.



Pick an apple! 
Extract Directly from Time Machine

Normally you use Time Machine to restore lost data in a file like this: within the Time Machine interface, you go back to the time the file was not yet messed up, and you restore it to replace the file you have now.

You can also elect to keep both, but the restored file takes the name and place of the current one. So, if you have made changes since the backup took place that you would like to keep, they are lost, or you have to mess around a bit to merge changes, rename files, and trash the unwanted one.

As an alternative, you can browse the Time Machine backup volume directly in the Finder like any normal disk, navigate through the chronological backup hierarchy, and find the file which contains the lost content.

Once you've found it, you can open it and the current version of the file side-by-side, and copy information from Time Machine's version of the file into the current one, without losing any content you put in it since the backup was made.

Submitted by
Eolake Stobblehouse


Time Machine Exposed!

Send Article to a Friend

Hard on the heels of my discovery of a version of GrandPerspective that lets you peer into your Time Machine backups to see what big unnecessary files they contain, here comes tms, a command-line tool by Robert Pointon that lets you explore your Time Machine backups in ways that were previously impossible.

To use tms at this early stage you have to be willing to fiddle with the command-line in Terminal. (If there is eventually a GUI version, one would expect it to be pretty great, since Pointon is the author of the astonishing fseventer, which lets you track every file change on your hard disk in real time.) But I know you're curious, so laugh insanely and give it a try.

Start by downloading tms. Move the resulting zip file to your Desktop and double-click it. A folder called "tms" appears on your Desktop. In the Terminal, say:

$ cd Desktop/tms
$ sudo cp tms /usr/local/bin

You'll be asked for your password. You have now installed tms so that it's available as a command-line tool. To test that this is so, say:

$ tms help

You'll see a list of available sub-commands (to use them, precede them by "tms"). For example, let's learn the status of our Time Machine backup:

$ tms status
/Volumes/SecretSharer: name=...
/Volumes/SecretSharer/Backups.backupdb/hume: name=...
/Volumes/SecretSharer/Backups.backupdb/hume/2008-05-01-100145: num=205 ...2008-05-01-10:01:45.551763

(The ellipses indicate places where I've omitted parts of tms's response.) Okay, so tms sees my backup disk (SecretSharer) and it tells me that my most recent backup is number 205 and was performed on May 1 at 10 AM.

Now let's track a file backwards through time. Hmmm, I wonder how many different versions of iTunes I've stored since I started keeping Time Machine backups?

$ tms log /Applications/
...num=1 oldest=2007-11-01-10:33:29 newest=2007-11-05-03:38:41
...num=40 oldest=2007-11-05-20:10:38 newest=2008-02-12-06:32:14
...num=199 oldest=2008-03-12-19:49:47 newest=2008-04-04-17:38:20
...num=202 oldest=2008-04-05-13:56:09 newest=Current

So I've got four versions of iTunes stored; besides the current version, there's the version in the snapshot of April 4, the version in the snapshot of February 12, and the version in the snapshot of November 5 of last year. Sure enough, if I enter the Time Machine interface, select iTunes, and use the backwards-arrow to move backwards in time, those are the four versions I'm shown. So with tms, I'm exploring my Time Machine backups without having to use the Time Machine interface!

Next let's get a list of all snapshots:

$ tms snapshots
...num=205 ... complete=2008-05-01-10:01:45.551763
...num=204 ... complete=2008-04-25-08:35:39.562235
...num=203 ... complete=2008-04-09-10:04:04.166687

So my most recent snapshot is 205. How big is it? How much had to be backed up in that snapshot? It turns out that every time Time Machine does a backup, it keeps extensive log information about what happened. But it isn't normally willing to show you that information! With tms, you can see it:

$ tms snaplog 205
...num=205 state=4 type=1 ver=1 start=2008-05-01-10:01:33.086632
Running preflight...
Calculating size of changes
Should copy 3027 items (663.7 MB)...

And now for the moment of truth. Okay, tms: so between snapshots 204 and 205, what changed? Exactly what did snapshot 205 actually back up?

$ tms delta 205 204

The result is a long list of files. Each file's pathname is followed by one of three symbols. A right-arrow means that this file didn't exist in the previous snapshot.

... ->

Makes sense; I only recently installed SunFlower.

A left-arrow means the file was deleted; it exists in the earlier snapshot, but not in the later.

...Desktop/ <-

Yup, I remember that file; it was a Web Location file. I deleted it after I entered its information among my bookmarks.

A not-equal sign means the file was changed and had to be backed up again.

...Documents/Bookmarks/Startup Items/MattsBookmarks: !=

That's the bookmarks file where I entered the Web Location information.

Well, that's enough playing for now. I hope this suffices to show the kind of thing tms can do. And don't worry; it has no write capabilities, so it can't harm your Time Machine backups - it merely explores them.


READERS LIKE YOU! Support TidBITS by becoming a member today!
Check out the perks at <>
Special thanks to Steve Werner, Pierce J. Flynn, Jill D Miller, and
Curtis Blanchard for their generous support!