Is there a way to see if a macbook had a time machine backup done?

Question

I was wondering if there's any way to see if someone did a Time Machine backup on a macbook.

Answer 1

From what I'm gathering you want to see if anyone accessed your computer to make a backup of it. I found this thread which might answer your question for how to retrieve the time machine backup logs from your Mac. Run the following command in Terminal

log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

which will show the most recent backups made. There is one change needed since log files can show activity of another account, if your Mac doesn't have your log in trusted as an administrator, you need that permission to do the search. Just add sudo to the above command as shown below:

sudo log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

Answer 2

I think this might help:

The Time Machine Mechanic (T2M2) – a quick but thorough check of Time Machine backing up

It’s a free tool from Howard Oakley, who describes it this way:

T2M2 analyses your logs to discover whether Time Machine backups have been running normally, reporting any worrying signs or errors. You do not need to be able to read or understand logs to be able to check for problems now. Reports deep event traversals, compaction of volumes, regularity of backups, and more. Detailed Help book explains results and advises. New version enhances reporting of free space on backup volumes.

That’s where I’d start!

Answer 3

You can use this command:

defaults read /Library/Preferences/com.apple.TimeMachine Destinations

to read the configured backup destinations. Each entry will include a list of "SnapshotDates", showing when the Mac was backed up to that destination. Note: it won't list snapshots that have been deleted/expired, or destinations that have been removed from the configuration.

Answer 4

Time Machine preferences will show you all disks used to back up the machine, and date ranges for the backup. Unless someone was particularly malicious and deleted that backup location from the MacBook prefs after completing it, you should be able to determine the date of last backup to a given drive.