Time Machine Exposed!

Hard on the heels of my discovery of a version of GrandPerspective that lets you peer into your Time Machine backups to see what big unnecessary files they contain, here comes tms, a command-line tool by Robert Pointon that lets you explore your Time Machine backups in ways that were previously impossible.

To use tms at this early stage you have to be willing to fiddle with the command-line in Terminal. (If there is eventually a GUI version, one would expect it to be pretty great, since Pointon is the author of the astonishing fseventer, which lets you track every file change on your hard disk in real time.) But I know you’re curious, so laugh insanely and give it a try.

Start by downloading tms. Move the resulting zip file to your Desktop and double-click it. A folder called “tms” appears on your Desktop. In the Terminal, say:

$ cd Desktop/tms

$ sudo cp tms /usr/local/bin

You’ll be asked for your password. You have now installed tms so that it’s available as a command-line tool. To test that this is so, say:

$ tms help

You’ll see a list of available sub-commands (to use them, precede them by “tms”). For example, let’s learn the status of our Time Machine backup:

$ tms status

/Volumes/SecretSharer: name=...

/Volumes/SecretSharer/Backups.backupdb/hume: name=...

/Volumes/SecretSharer/Backups.backupdb/hume/2008-05-01-100145: num=205 ...2008-05-01-10:01:45.551763

(The ellipses indicate places where I’ve omitted parts of tms’s response.) Okay, so tms sees my backup disk (SecretSharer) and it tells me that my most recent backup is number 205 and was performed on May 1 at 10 AM.

Now let’s track a file backwards through time. Hmmm, I wonder how many different versions of iTunes I’ve stored since I started keeping Time Machine backups?

$ tms log /Applications/iTunes.app

...num=1 oldest=2007-11-01-10:33:29 newest=2007-11-05-03:38:41

...num=40 oldest=2007-11-05-20:10:38 newest=2008-02-12-06:32:14

...num=199 oldest=2008-03-12-19:49:47 newest=2008-04-04-17:38:20

...num=202 oldest=2008-04-05-13:56:09 newest=Current

So I’ve got four versions of iTunes stored; besides the current version, there’s the version in the snapshot of April 4, the version in the snapshot of February 12, and the version in the snapshot of November 5 of last year. Sure enough, if I enter the Time Machine interface, select iTunes, and use the backwards-arrow to move backwards in time, those are the four versions I’m shown. So with tms, I’m exploring my Time Machine backups without having to use the Time Machine interface!

Next let’s get a list of all snapshots:

$ tms snapshots

...num=205 ... complete=2008-05-01-10:01:45.551763

...num=204 ... complete=2008-04-25-08:35:39.562235

...num=203 ... complete=2008-04-09-10:04:04.166687

...

So my most recent snapshot is 205. How big is it? How much had to be backed up in that snapshot? It turns out that every time Time Machine does a backup, it keeps extensive log information about what happened. But it isn’t normally willing to show you that information! With tms, you can see it:

$ tms snaplog 205

...num=205 state=4 type=1 ver=1 start=2008-05-01-10:01:33.086632

...

Running preflight...

Calculating size of changes

Should copy 3027 items (663.7 MB)...

And now for the moment of truth. Okay, tms: so between snapshots 204 and 205, what changed? Exactly what did snapshot 205 actually back up?

$ tms delta 205 204

The result is a long list of files. Each file’s pathname is followed by one of three symbols. A right-arrow means that this file didn’t exist in the previous snapshot.

... SunFlower.app: ->

Makes sense; I only recently installed SunFlower.

A left-arrow means the file was deleted; it exists in the earlier snapshot, but not in the later.

...Desktop/classicaland.com:index.asp.webloc: <-

Yup, I remember that file; it was a Web Location file. I deleted it after I entered its information among my bookmarks.

A not-equal sign means the file was changed and had to be backed up again.

...Documents/Bookmarks/Startup Items/MattsBookmarks: !=

That’s the bookmarks file where I entered the Web Location information.

Well, that’s enough playing for now. I hope this suffices to show the kind of thing tms can do. And don’t worry; it has no write capabilities, so it can’t harm your Time Machine backups – it merely explores them.