
- /Volumes/Time\ Machine/
*.previous
- /Volumes/.timemachine/
*/*.backup
(mostly empty directories, but one is a weird mount point on the external disk)
- /Volumes/
com. apple. TimeMachine. localsnapshots/ Backups.backupdb
(when do these get written?)
And more to the point, how do I access a file in an old time machine archive from the command line, e.g. to run diff on it?
Also... whyyyyyy? I know they had to extend HFS to allow hard links to directories to make the .backup bundles work, and that's why Time Machine archives on network drives are .sparseBundles impersonating a block device with an HFS file system inside, but did they just lose their damned minds completely when it came to APFS?
Update: Wow, it is all completely insane.
Howard Oakley has written a lot on this, and someone made this index of his posts. So here's my summary of a summary of what's going on now:
- Your system APFS disk makes hourly backups using "snapshots" which are a file-system-level checkpoint. Basically it lays down a marker at a timestamp and all subsequent changes are stored as deltas that can be rolled back.
These snapshots are read-only and are only accessible by mounting magic, and are normally left unmounted.
Your USB-connected APFS Time Machine drive also uses "snapshots". The backup process is to drop a snapshot marker on that drive, then copy over all changes. Maybe by copying files, maybe by copying a snapshot from the source disk directly.
The "/Volumes/Time Machine/
YYYY-MM-DD-HHMMSS.previous/ " directory is the most recent backup on the external drive, and previous backups are hidden within that as APFS file system snapshots. It gets renamed to the current timestamp as updates are made.When you open your "/Volumes/
Time Machine/ " drive in Finder, it just lies right to your face. Finder synthesizes a list of available backups and conspires to mount the snapshots as you open the disclosure triangles.Finder makes it look like "/Volumes/
Time Machine/ " exists. It does not. It is mounted by Finder as needed on "/Volumes/.timemachine/UUID/YYYY-MM-DD-HHMMSS/ YYYY-MM-DD-HHMMSS.backup/ ".YYYY-MM-DD-HHMMSS.backup/ Data/ Command line utilities are not granted the same background magic as Finder. If you want to access a file with diff or whatever, you first have to open its parent backup in Finder to get it mounted and find the real pathname. You could also mount by hand, but that's really complicated.
Even with all of these "advancements", it is still completely normal and expected for the progress indicator on a Time Machine backup to say "about 6 hours remaining" for 14 hours. If there is one thing at which Apple is the all time world champion, it is misestimating completion times to a truly pathological degree.
"The Aristocrats!"