Time Machine: Some Details
January 26th, 2008
There are a couple things I’ve noticed about Time Machine that are worthy of mentioning. Yes, Time Machine is a great application and the Mac world will be a better place for it. And despite its admirable job of hiding all the nitty gritty from sight, the nitty gritty is still back there, making things happen. You can try to simplify backup — but the fact remains, backup isn’t simple.
Renamed Files and Folders
I’d read some speculation that Time Machine might be very, very smart. That it might somehow tag your files in a way that it knew when you renamed or moved one. The hope here was that Time Machine wouldn’t copy a renamed file to your backup drive and store it twice. Not so. Time Machine does make the copy.
Example: A big folder with hundreds of images gets backed up at 3PM. You change the folder name at 6PM. The entire folder and all its contents get copied to the backup drive. Yes, all those files now reside on your drive twice. Once with each name. If you kick off Time Machine manually and watch in System Preferences you can see the files getting copied. Now the same set of files is claiming twice the amount of space you might want them to occupy.
Files not Included in Daily Backup
The second thing concerns the backup stored on a daily basis. Remember, Time Machine keeps an hourly backup for the last 24 hours. And a daily backup for the last month. What might surprise some people is which backup is selected as the daily backup. It’s the first one of the day. In other words, if you go into Time Machine on Friday and fly back through its space-time continuum to Monday’s backup looking for a file you created during Monday Night Football — it won’t be there. It will be in the daily backup for Tuesday, assuming you didn’t delete it Monday night.
It’s not a big deal. And let’s be clear, I’m not saying it’s a flaw either. If it makes you feel better you can think of Tuesday as the daily backup for Monday. But there’s something important to be aware of.
Let’s assume you keep your Time Machine drive plugged in all the time. If you create a file at 6pm on Monday and delete it at 10pm it will be on the hourly backups created Monday evening. But it won’t be on the daily backup for Monday or Tuesday - or any other day. When those hourly backups drop off the file is gone.
This might never matter to you. But if you’ve gotten much more confident with the Delete button since you started using Time Machine this is something to be aware of.
The bottom line: Files created and deleted the same day might never make it to the land of daily backups. You’ve got about 24 hours to recover such files if you need them. If you want to make sure a new file gets rolled into a daily backup and thus have it accessibile for a longer time frame: don’t delete it until after the first backup the next day.
| Permalink
January 26th, 2008 at 11:52 am
I’d assumed the ‘renaming a folder’ thing worked like that but I hadn’t known about the daily backup thing — thanks for that!
I haven’t really given much thought to Time Machine since I plugged my drive in and clicked “Yes”, although I did stop it from backing up system files — I think I read how to do that on MacOSXHints.com.
January 26th, 2008 at 12:53 pm
I skip system files too. And Fusion!
January 27th, 2008 at 12:15 am
Hi Murphy,
New to Leopard, Time Machine and the whole backing up thing so please excuse my ignorance, but why should I exclude system files and applications from TM?
Thanks,
Dave
January 27th, 2008 at 12:43 am
dave -
I’m not saying you should. I’m using a relatively small drive. So I don’t have lots of space for files that could be replaced with a reinstall.
If your Time Machine drive is large enough I’d include the system files.
In my case I’m only interested in backing up files that are otherwise irreplaceable.
January 27th, 2008 at 5:29 am
Good post! I had no idea about which hourly backup goes into the daily one. I, personally, love the Time Machine auto backup. It makes it very easy and very… well, Apple like!
Of course, as I write this my external hard drive failed and I’m working sans backup. I’m considering what I want to do: either get a new HD for my enclosure or buy of of those G-Drives. What to do, what to do.
BTW, I didn’t include new Time Capsule because I do not like the fact that if the hard drive fails, I’m not sure what Apple will charge me to get a new one in there.
January 28th, 2008 at 3:50 pm
I think the “Daily” backup behavior makes perfect sense….
So the last hourly backup from “Monday” begins at…. midnight. Which is technically “Tuesday.” But that’ll be the one that contains the most updated Monday info (FIles created @ 11:59pm). The only issue is that it’s referred to as the backup from ‘Tuesday.’ You eluded to this in the article, but I thought it was worth sharing WHY it makes sense and isn’t a fault of the program – it’s doing the right thing, though perhaps they should have called that midnight backup ‘Monday’ instead. But logically, it’s correct in the timing strategy.
January 28th, 2008 at 8:27 pm
Waiting for the Daily Backup missing files “feature” to be spun by the Blogsphere into something akin to Safari’s “Private Browsing”…
Don’t want your wife in your Time Machine? Simply delete risky content same-day, and — Boom! — Time Machine covers your tracks…
January 28th, 2008 at 10:17 pm
I am a bit shocked at your results in that they are specifically the opposite of what Apple advertises. Are you really sure that the behaviour you describe is what is happening?
The renaming of the folder example is supposed to induce a copy of the folder but not the contents (using hard links). Apple has also *specifically* stated that the hourly backups are all smooshed together so that no changes or deletions of any files made throughout the day are lost.
I don’t know who to believe now.
January 28th, 2008 at 10:54 pm
Jeremy
I’ve seen quite a few posts on various forums that report the same results I got.
The links you’re referring to - that’s something else. When you use Finder to look at your Time Machine drive you can look in folders for all the different backups. And the files appear to be in all of them. In other words, a file created on Monday appears to be in the Tuesday and Wednesday folder. But it’s not stored in all those places, it’s linked. Because the file didn’t change.
My example deals with folder and files that have changed. The main point: ONE folder name changing results in all its contents being copied again. Some people won’t like that, but it’s not unusual behavior as far as backup goes.
January 28th, 2008 at 11:25 pm
Thanks, I had known about the renaming thing, but not the daily thing.
I have a large enough drive that I let system get backed up, but have decided to exclude the /Library/Updates folder because of how I’ll use Time Machine in conjunction with Software Update. I’d be downloading updates right when they’re released, but wait maybe a week (until I’m sure they’re safe) before installing them and I don’t want those update installers getting backed up (who does?, you can re-download them if you need to).
January 31st, 2008 at 5:21 pm
this is pretty much what I have discovered after lots of testing. Further, the weekly backups SEEM to be based on the date of the first backup, you get a weekly every 7 days after that. A month is really 30 days too.
When the TM disks fills (I did it in less than 2 weeks with a disk 3x the size of the internal disk), TM starts “thinning” the oldest backups. That means that the first to go is the INITIAL backup. Anything that hasn’t changed since then is lost in the sands of time except enough of the system to make a bootable restore. Do not expect TM to be an archival backup.
See more musings at
http://www.girr.org/mac_stuff/backups.html
- gws
February 6th, 2008 at 6:26 am
Hard links make it look like you have several copies of a file, but they actually all point to the same data on disk. So I would assume that even when you see two copies of the folder, the files exist only once on disk. OTOH, if you rename or modify a large disk image…
February 6th, 2008 at 3:02 pm
philippe -
Your assumption is not correct. Read the whole post. I tested this and concluded the renamed folder had its contents copied again. Not hard links. People see hard links in each backup for files that didn’t change, or have their parent folders renamed. but when a folder is renamed its contents are copied. I verified by checking used space before and after on the drive. Try it.
March 19th, 2008 at 2:52 pm
i have new mac since dec 07 and now decided to buy external drive and use time machine. question. i have a lot of photos and have not deleted any. they are both now on my ex-drive and computer. can i start deleting bad photos from my computer since they are already on my ex-drive or will they be deleted from my ex-drive as well once time machine runs? thanks for your guidance.
March 20th, 2008 at 1:59 am
marcos - as long as they made it into a daily backup they’ll be on your external drive for a while. But anything you delete from the computer will eventually be deleted from the external.
maybe you should make a long-term archive of your photos on another drive or copy them to dvds. Or both.
March 23rd, 2008 at 2:59 pm
Thank you! That helps!
May 20th, 2008 at 7:30 am
Murph - your description of folder copying makes no sense. A hard link is a pointer to a block of data on the disk. It doesn’t matter to the hard link whether it’s in directory A or B - it still links to the same block of data.
If what you are describing is happening I can only assume it’s a bug in TM and will be fixed in one of the next releases. There is no technical reason for this to happen.
The daily backup behavior is subtle but on the other hand it’s what you would expect. The point is not to get the “most recent” from monday, but to do daily backups. What time of the day the backup is from is irrelevant - any kind of bad situation you describe with a monday morning backup can also happen with a monday night backup. The only thing that matters is that the backup happens regularly every 24h.
May 20th, 2008 at 1:17 pm
You’re entitled to your opinion nikster, but the more information people have about backup the better. If someone is relying on something being rolled into the backup for that day it won’t necessarily happen. If people delete something they created that day thinking Time Machine has it they could be wrong. If you think it’s irrelevant I don’t think you understand the post.
I don’t think you understand how Time Machine uses links. The fact remains that the data is being copied again and taking up MORE space if you rename. Since the total amount of free space is reduced by renaming something than I don’t see your point at all. Call it whatever you want - but I actually tested it. If my results were wrong I think readers of the Ars article linking to me would have pointed it out. They didn’t.
May 23rd, 2008 at 11:00 am
I am curious if somebody had the issue that an external drive which is backed up by TM has crashed?
I currently have this situation and I am wondering how I can get the data back up after I plugged in a new drive. Time Machine itself does not recognize the new drive as a replacement of the old of course so they must be a way of telling TM to restore the data to a specific new destination which is unknown to TM before.
Also I would be curious what behavious TM shows when it has restored the data to a new destination and if as described by some earlier “forgot” the previous backup data.
I am looking forward for some helpful posts!
Regards from Berlin,
Holger
August 1st, 2008 at 9:54 pm
If you are worried Time Machine deleting something important (like photos perhaps), you can just copy them to the drive outside of Time Machine and thus they will be safe. It would make TM start deleting old stuff sooner if you put them on the same drive obviously because their would be less space but it’s an idea to get around the whole daily backup thing. I would only do it for the important stuff.