Time Machine - List of Files that were backed up

Question

I'd like to know to see which files are getting backed up by my time machine? I often see a large amount of data being transfered and I'm not sure sure what it is.

Answer 1

The command tmutil compare lets you compare file lists if you don't want to do it using ls or other commands that can show differences in files and folders like rsync and many graphical diff programs.

You can list backup paths and then copy them into the compare command. Example:

sudo tmutil listbackups
sudo tmutil compare "path1" "path2"

Many people adore BackupLoupe as well. It makes a powerful database of what files are included with each backup interval.

Answer 2

If you're interested in seeing what files are being read as the backup happens, you can use this command:

sudo opensnoop -n backupd | grep -v 'Time Machine Backups'

Note: the above worked in earlier versions of macOS. In High Sierra, something approximating this is:

sudo fs_usage -f filesys backupd

However there's a lot of noise from the backup volume itself that I haven't figured out how to get rid of.

Answer 3

You can use timedog for that.

timedog is a Perl script that displays the set of files that were saved for any given backup created by Mac OS X Time Machine. By default it shows those files that were saved in the most recent backup. The listing includes the file sizes before and after, as well as a total file count and size. The script includes an option to summarize changes to a particular directory depth, producing a more concise display, helping to get an understanding of which areas of your system are taking up the most space in the backups. It can also sort by size, and/or omit files below a given size.

Answer 4

If you want to watch which files are being transfered in realtime you can monitor the time machine daemon with

sudo fs_usage -f -R filesys backupd

If you see abnoramly large file transfer you might see disk images from virtual machines in the list

Answer 5

I combined the above tmutil answer by BMIKE into this handy one-liner, hopefully it can help someone!

This will take the last 2 backups, and diff them for you. The sed is to put quotes around the backup names which will probably have spaces in them.

sudo tmutil listbackups | tail -2 | sed 's/.*/"&"/' | xargs  sudo tmutil compare

Answer 6

I really like this commercial software BackupLoupe for analysing my backups.