How do I see what files are new in a Time Machine backup?

Question

As I understand it, Time Machine creates hard links for all the previous files in a backup, so each timestamped backup folder appears as a full snapshot of the files at the time of the backup. How can I find out which files are new for a given backup and which files were carried forward from the previous backup?

Answer 1

If Time Machine is actually using hard links, you can use 'ls -l' to display the link count for a file. In theory, new files will have a link count of 1. For example:

  $ touch foo
  $ ls -l foo
  -rw-r--r--  1 lars  staff  0 Dec  4 00:22 foo

The second field is the link count. Let's create a link:

  $ ln foo bar
  $ ls -l foo bar
  -rw-r--r--  2 lars  staff  0 Dec  4 00:22 bar
  -rw-r--r--  2 lars  staff  0 Dec  4 00:22 foo

Note that the link count has increased.

You can use the 'find' command to find all files with a single link:

$ find /path/to/backup -links 1 -print

Answer 2

BackupLoupe is $1, excellent, and does just this.

And yes, it does use hard links. This article (part of a 10.5 review on arstechnica) explains how Time Machine works and is a very interesting read.

Answer 3

Compare snapshots

In Lion or greater:

• use the compare verb of tmutil.