The Pane Time Machine

Time Machine Basics

Time Machine is the name of Apple’s technology which automatically creates backup copies of your computer’s hard drives. Backups are created silently in the background each hour. Outdated file sets are automatically removed, keeping hourly backups for the last day, daily backups for the last week, and monthly backups until the destination device is full. Each backup set contains a nearly complete snapshot of the contents of all disks for which Time Machine has been activated. “Nearly” means that Time Machine automatically omits files which are considered unimportant or which can be recreated, like log files, the Trash, caches, the Spotlight search index, etc. Although the entire system can be restored for each point in time for which a backup is available, Time Machine technically only stores the differences between any two given consecutive backup operations (incremental backup). Differences are handled at the file level, i.e. if a single byte in a file X has changed, the entire file X will be copied during the next Time Machine backup run.

General Notes when Working with the Time Machine Pane

Time Machine can be configured to work with multiple destination devices at the same time. In addition to disk drives, destination devices can be servers in the network (such as Time Capsule), a Mac running Time Machine file sharing (available in old versions of macOS Server and in standard versions of macOS as of version 10.13), or a NAS with Time Machine support. TinkerTool System automatically detects your configuration and always works on the Time Machine destination that is currently defined by macOS to be the “active” one. The name of the destination is shown at the left bottom of the Time Machine pane (Active Time Machine disk). If you replace Time Machine devices while TinkerTool System is running, you can click the button Rescan at the right side of the pane to ensure that the application learns about the possibly changed active device immediately. In most cases, TinkerTool System will detect this automatically after a short time. However, from within TinkerTool System you cannot change which destination device Time Machine currently considers the active one.

If your Time Machine destination is network based, click the button Connect to network disk to let macOS connect to your backup. You cannot use any of the Time Machine features until the connection is made. To disconnect later, click the button Eject network disk. You should only disconnect if no Time Machine operations are currently running.

TinkerTool System automatically tries to determine if a backup operation is currently in progress. In this case, the warning message A backup or other Time Machine operation is currently running. is shown at the bottom of the window. Although it is usually safe to use other Time Machine features during this phase, we don’t recommend doing so, because the two simultaneously running operations could slow down each other, causing significant performance problems.

There can also be the warning message Time Machine is not ready at the moment. Please wait. In this particular case, Time Machine indeed cannot be accessed at all and TinkerTool System has to wait until the backup system becomes operational again. The two most typical causes are:

• Time Machine has been enabled only recently, but the very first backup has not been completed yet. In this case you have to wait until there is at least one backup session available.
• With some versions of macOS, Time Machine may experience an internal error state which causes it to send contradictory data when being asked about its current configuration. This defect usually resolves itself within a few minutes. We recommend waiting and clicking the button Rescan after some time to check whether macOS has recovered. You can expedite this by opening the Time Machine user interface, verifying that the timeline is completely filled and then quitting the Time Machine screen again.

It is also recommended to disconnect from a network-based Time Machine backup volume when you completed your work with Time Machine features in TinkerTool System. The application needs to perform some monitoring tasks in the background while the network connection is active. This could slightly slow down the program and your network, especially if you are using WiFi.

Maintenance After Replacing a Data Source of Time Machine

The incremental backup strategy mentioned in the introduction only works if Time Machine can be absolutely sure which files have changed between two consecutive backups and which haven’t. If Time Machine cannot confirm that a given file is identical to the one it saw during a previous run, that file will be freshly copied in the next run.

When the identity of your computer changes, for example if you purchased a new one, or if it had components replaced during a repair, Time Machine has to assume that all the files of your computer have changed. This is true even if you have “cloned” or manually copied the files from the old to the new computer. This means that during the next backup, Time Machine will copy all the files again. Only if you use Time Machine itself to perform a full restore operation of the previous data, will Time Machine “know” that it can safely reuse the previous incremental backup.

The same problem arises if you replace a volume of your Mac, but use something other than Time Machine to copy the data back. Replacing a volume can mean

• you replaced a disk drive physically,
• you erased or reformatted a partition,
• you cloned a volume by a third-party application, but the original and copied volumes were attached to the computer at the same time, so that the system had to change the identity of one volume to keep track of which is which.

Only if you copy a disk drive or partition physically (i.e., by a copying the raw data blocks, not file by file) and make sure that the operating system where Time Machine is active doesn’t mount both volumes simultaneously, will Time Machine seamlessly continue its incremental operation. In all other cases, Time Machine has to assume that all files on the entire affected volume have changed and therefore must be fully copied again.

TinkerTool System can help here, letting you manually confirm to Time Machine that a computer or a volume should still be considered the same, although its identity changed. This way, the new item will take over the role of the replaced item, and its history in Time Machine can be continued without requiring a full new backup.

Inheriting a Time Machine Backup Set from a Replaced Computer

If you need to confirm that Time Machine can safely take over a backup set that was created by a different physical computer or by a different operating system installation on the same computer, you can reassign the backup set to your current system. You should only do this in the aforementioned scenario, where all files have indeed be copied to the new system installation by some other means (not under control of Time Machine). Perform the following steps to do this:

1. Open the tab item Maintenance on the pane Time Machine.
2. Click the button Assign a foreign backup to this Mac….

TinkerTool System will guide you through all steps of the procedure. You will need to locate the foreign backup set to complete the operation. In case of a local Time Machine disk, this will be the top folder of the backup set. It has the name of the previous computer and is located in the folder Backups.backupdb on the destination disk. For a network-based backup, you will need to connect to the file service hosting the backup first. Here, the backup set is stored in a sparsebundle disk image. It also bears the name of the previous computer.

Depending on how Time Machine was configured before inheriting the foreign backup set, you might need to re-enable Time Machine on the Time Machine pane of System Preferences and change the backup destination.

In case the local volumes of the current computer are different from the ones of the previous computer, inheriting the backup set alone won’t be sufficient. You will additionally need to reassign each volume, which is described in the next section.

Associating a Replaced Volume with a Volume in the Backup Set

As outlined in the introduction, there can also be cases where you need to confirm to Time Machine that it can safely take over the history of a volume in the backup, although the identity of the original source volume has changed. You can reassign a volume in the backup (for all snapshots recorded by Time Machine) to match a volume of your current setup. You should only do this in the previously mentioned scenario, i.e. where all files have indeed been copied from the previous volume to the new volume (not under control of Time Machine, so that Time Machine did not “notice” it). Perform the following steps to do this:

1. Open the tab item Maintenance on the pane Time Machine.
2. Click the button Confirm a copied volume to replace a previous volume….

Three items need to be specified:

• a snapshot in the current backup set that includes one of the backups of that volume,
• the name of that volume as it was recorded at the time of the selected snapshot,
• the name of the new volume in your current installation that should match the volume in the backup set.

TinkerTool System reassigns that volume for the entire time line recorded in that backup set, i.e. for all snapshots. It does not matter if the previous volume changed its name during the recorded time period. Time Machine identifies the volume correctly tracking its internal history data.

Do not abuse the two maintenance features to manipulate the backup in any other cases that have not been mentioned here. The backup set could become unusable.

Backup Verification and Statistics

TinkerTool System gives you access to internal check features of Time Machine. You can learn more about the actual storage size needed by the individual snapshots, and you can initiate a verification run on selected snapshots, ensuring that the contents of the backup are still intact.

Computing Statistics on the Change Rates between All Snapshots

As mentioned in the introduction, Time Machine simulates that each snapshot contains a complete copy of all data that was part of the backup at the recorded point in time. So if your computer always stored approximately 500 GB of data on its disks and 50 snapshots have been recorded by Time Machine, the destination volume appears to virtually contain 500 GB ⨉ 50 = 25,000 GB of data. This large amount of data is not really stored on the disk, however. In reality, Time Machine optimizes storage space on its destination disks by recording only changes between consecutive backup runs. To estimate the storage space that is usually consumed by each snapshot, it can be helpful to evaluate the changes between backup runs and to compute the average rate of change. To do this, perform the following steps:

1. Open the tab item Checks on the pane Time Machine.
2. Click the button Compute Statistics.

Note that all files on the entire Time Machine disk need to be analyzed for this computation. This will take a considerable amount of time.

TinkerTool System creates a text report after Time Machine has completed the computation. This report can be saved to a text file if necessary.

Verifying the Contents of a Volume Snapshot

To be absolutely sure that the backup copy of a volume for a specific point in time can be read without problems and is fully intact, you can force Time Machine to validate its internal checksums. As of version 10.11 of the operating system, Time Machine protects each file in the backup by computing and recording a checksum for the content of that file. To verify a backup run for a volume, perform the following steps:

1. Open the tab item Checks on the pane Time Machine.
2. Use the pop-up button Snapshot to select the time of the backup that should be checked.
3. Use the pop-up button Volume to select the volume in the snapshot that should be verified.
4. Click the button Verify selected backup.

The check will need a considerable amount of time. If problems are identified, TinkerTool System will show a table with all issues after the verification has been completed. The table will list the full paths of the files in the backup where a problem was detected. There can be two types of problems, indicated as follows:

• File modified: the file in the backup did not match its checksum. Either the file could not be read correctly or its contents changed unexpectedly.
• No check possible: the file could not be tested successfully because its checksum was not available. This indicator does not mean that you shouldn’t trust the copied file. It means that it is currently unknown whether the file is OK or not.

Possible reasons for cases where no check is possible could be:

• The snapshot was created with an operating system prior to version 10.11.
• The checksum is currently in use because another Time Machine operation (e.g. a new backup session) is currently running in the background. In this case you should repeat the test, perhaps after temporarily disabling automatic backups.

The list of possible reasons depends on the operating system version and may not be complete.

Computing the Actual Storage Size of a Volume Snapshot

In addition to the change rates between consecutive snapshots, it can be interesting to know the actual storage size consumed by a snapshot that contains the backup copy for a specific volume. Due to the internal optimization of Time Machine, this size can be very different from the simulated size for the related backup folder shown in the Finder or by similar applications listing files.

To let Time Machine compute the true storage size of a volume snapshot, perform the following steps:

1. Open the tab item Checks on the pane Time Machine.
2. Use the pop-up button Snapshot to select the time of the backup that should be evaluated.
3. Use the pop-up button Volume to select the volume in the snapshot that should be evaluated.
4. Click the button Analyze selected backup.

TinkerTool System summarizes the size value in a message that will be shown after the computation has been completed.

The actual storage size can be zero if the contents of the selected volume did not change between consecutive backup runs.

For additional features related to verifying Time Machine operation and the size of snapshots, please also see the chapter The Pane Diagnostics.

Working with Local Snapshots

If at least one of the volumes selected to be part of the backup uses the modern Apple File System (APFS), Time Machine will automatically enable additional features:

• Every time a backup session is started, Time Machine will create an APFS snapshot of each APFS volume that is about to be copied. An APFS snapshot is basically a frozen image of the source volume, created at the time the backup began. Even if files are changing while the backup session is running, the snapshot will ensure that Time Machine only “sees” a static picture of the volume. If the backup copy must be restored later, the result will reflect a consistent state of the volume, without any files that have been in an “in-between” condition only.
• Each APFS snapshot will be kept by the operating system on each volume as long as this volume has enough storage space. The snapshot is basically invisible during normal operation and only needs a small amount of additional storage space. It is based on the strategy to never reuse any block of the volume that had been occupied by a file for any new files, even when that file has been deleted or this part of the file has been changed.
• APFS snapshots are not only created when normal Time Machine backups are made, the operating system also creates them when major changes in the system are to be expected, e.g. when an operating system update is about to be installed.
• These snapshots can be used as “restore points” that allow you to very rapidly reset an entire APFS volume to a consistent state of the past. This is done via Time Machine (usually after starting the recovery system), selecting the APFS volume itself, not the actual Time Machine volume, as source for a restore operation. For more information, please see Apple’s official documentation on macOS.

This basically means that an APFS snapshot can be used as a local snapshot of Time Machine. Working with these snapshots doesn’t require access to the actual Time Machine backup volume.

Other parts of macOS can use the APFS snapshot feature as well. The list shown on the tab Local Snapshots considers APFS snapshots created by Time Machine only. If you like to work with the complete list of APFS snapshots, please see the chapter The Pane APFS.

It is under sole discretion of the operating system when to automatically create or to remove APFS snapshots. TinkerTool System gives you additional manual control about these local snapshots, however.

• You can create a local snapshot immediately, just by clicking a button. This is helpful to create a well-defined restore point, e.g. when you like to test a possibly “dangerous” action on an APFS volume that might need to be undone in the near future.
• You can review which local snapshots are currently available on each APFS volume.
• You can force macOS to clean up its local snapshots immediately, to bring forward the point in time when this would happen automatically. This is done by specifying a planned amount of storage space that should be reclaimed during the cleanup. macOS will keep as much snapshots as it can to meet this target.
• You can delete local snapshots of your choice.

To create a new local snapshot on all APFS volumes that are part of your Time Machine backup, perform the following steps:

1. Open the tab item Local Snapshots on the pane Time Machine.
2. Click the button Create local snapshot now.

Creating the local snapshot should typically require less than one minute.

You can review all snapshots using the table Available local snapshots on the same pane. The available points in time are listed as separate lines. By default, you will see a list for the entire computer. If more than one APFS volume is in use, it can also be interesting to see the list of snapshots on each volume. Note that the sets of available snapshots can be different on each volume because some volumes may have less free storage space, so they will automatically remove snapshots earlier than others. To select between different volumes, use the pop-up button above the table.

To reclaim storage space on a particular volume, select the volume with the pop-up button above the table, then click the button Reclaim storage space…. TinkerTool System will ask you in a dialog sheet how much bytes you like at least to be reclaimed. You can specify a low value (like 1) to make sure that only the smallest possible number of snapshots will be deleted. The operating system will use its standard policies to automatically select the snapshots that should be removed. At the end of the operation, TinkerTool System will show a summary how many local snapshots have been lost and how much storage space has been freed on the volume.

In some cases, Time Machine may decide to postpone the cleaning operation for some time. In this particular situation, TinkerTool System may not indicate that storage space has been freed yet immediately after requesting a reclaim procedure.

In order to free up as much space from a volume immediately, select the volume at Available local snapshots and click the button Delete all from this volume. Time Machine will understand this as urgent request to reclaim the maximum amount of storage space currently in use for local snapshots.

To delete a local snapshot manually, select it in the table and click the button Delete selected snapshot….

Deleting Time Machine Backup Data

Remove a backup snapshot from the currently active Time Machine disk

As part of its daily routine, Time Machine cleans up backups regularly, if necessary every hour. After a backup session has run, outdated backup snapshots are removed from the backup disk. Sometimes, you may like to remove a specific snapshot manually, e.g. to free some storage space. You must never do this via the macOS Finder. This could damage the Time Machine backup set, and in addition also the Trash feature of the Finder. TinkerTool System offers you a safe way to remove a Time Machine backup for a certain point in time:

1. Open the tab item Delete Backups on the pane Time Machine.
2. Select the snapshot that should be removed with the pop-up button at Delete in the upper part of the window.
3. Click the button Delete… next to it.

This operation removes items from Time Machine “horizontally”: All files and folders of a snapshot will be deleted, so you can no longer “travel back in time” to restore one or all files for this specific moment. All other snapshots remain intact, however. You can additionally remove items “vertically”, i.e. you can delete a specific file or folder from all snapshots in the backup set. This feature is already built into the Time Machine user interface:

1. Use the Finder to open the parent folder that contains the item to be removed.
2. Open the Time Machine user interface.
3. Select the object you like to remove in the Finder-like window of Time Machine.
4. Use the context menu (right click) to remove the selected item.

Remove any Time Machine data from local backup disks

Time Machine disks can be in use by multiple computers. You can store other data on a Time Machine disk as well, although this is definitely not recommended, because this additional data cannot become part of a Time Machine backup. (In case of disk failure, you would lose both the original data and the backup at the same time.) If you like to remove some or all Time Machine data from such disks, e.g. when you no longer need backups for a decommissioned computer, you again must not use the Finder to do so. This would risk that the entire file system of this disk and the Trash are damaged.

TinkerTool System can also help in this case, where the Time Machine data on disk does not necessarily belong to your currently active backup of the local computer. You can remove data from inactive backups or from backups of other Macs. In particular, you can delete

• all Time Machine data on disk (leaving other files and folders on that disk untouched),
• all Time Machine backups for a specific computer on a specific disk,
• a single backup snapshot for a specific computer on a specific disk.

Only directly attached hard drives are supported. You cannot use this feature to purge Time Machine data on network file servers.

If you have a “pure” Time Machine disk that only contains backups for a single computer and has no other data stored on it, the fastest solution to clean this disk will be to simply re-format it with Disk Utility, executing Erase on its main partition. However, if the disk was encrypted and should be re-used for new, encrypted Time Machine backups later, a delete operation via TinkerTool System could be faster overall, because the necessary re-encryption (that is not necessary for a manual delete process) could take a very long time.

1. Open the tab item Delete Backups on the pane Time Machine.
2. In the lower part of the window, make your choices for Time Machine disk, for computer and the Time Machine items to remove.
3. Click the button Delete….

Retrieving Time Machine Logs

macOS records a log file each time a Time Machine backup has run and a new snapshot was created. These logs are usually invisible, but TinkerTool System can retrieve them for each snapshot if required. Among other information, the log discloses data

• how long the backup run needed to complete,
• whether a full or incremental backup was performed,
• what storage size was needed,
• which files have been omitted,
• whether unusual situations occurred during the backup, etc.

The logs are only available in English, no matter what language you have chosen for the user interface. The reports are created by macOS, not by TinkerTool System, so their contents can change without notice depending on which operating system version has created them.

To open a log for a snapshot of your Time Machine backup set, perform the following steps:

1. Open the tab item Logs on the pane Time Machine.
2. Click the button Select snapshot… to select the time of the backup that is of interest.
3. Click the button OK.
4. Confirm to macOS that its helper program authopen should have permission to read the log.

TinkerTool System shows the contents of the log in the text area at Backup Log.