Searching time machine backup

[J10000]

I have a program that may be deleting data from a file and it is unknown when this occurs.

The device has a Time Machine backup and I would like to search the backups for all instances of this file and sort by date modified and / or filesize.

Is there an easy way to do this, perhaps via terminal?

I have attempted this command to search by filename without any luck.

sudo

find '/Volumes/Time Machine Backups/' -type f -name "*filename*"

Or alternatively is there a program that may do this without going into all individual backups using Time Machine to view the file?

Perhaps a command that just gives me all instances of the file or even one that just gives me the file date with the largest size may suffice.

Thank you for your assistance.

Cheers, J

 

[MacInWin]

Welcome to the forum.

I can suggest two applications. One is Find Any File and the other is EasyFInd. Both can be set to search the TM volume and will search for filenames just as you want. You can search for the two products. Get them from the developers to make sure nothing unwanted comes along.

 

[J10000]

Thank you for your reply, I have tried both apps and neither seem to find anything on the Time Machine backup.

I did however forget to mention this is a network location and I attempted mounting the folder with SMB and it still fails to find anything.

Any other options would be greatly appreciated.

Thank you again.

Cheers, Joe

 

[Randy B. Singer]

See if this free product will do what you want:

TimeTracker (free)

https://www.charlessoft.com

(scroll down the page to find it)

 

[MacInWin]

I did however forget to mention this is a network location and I attempted mounting the folder with SMB and it still fails to find anything.

Kind of important information as the way TM stores things on a network drive is very, very different from how it stores on a locally attached drive.

I don't know the tool Randy suggested, but one way to find the file is to find it on your internal drive, then enter TM and go to the same place in the Finder-like window of TM and scroll back in time to see the backups.

 

[J10000]

Yes apologies regarding network MacInWin, a major oversight indeed.

I can move the TM files to a USB drive, however I don't want to break the TM data I have until issue resolved.

Unfortunately backups go back to Jan 2018 and these file(s) can change multiple times per day, therefore scrolling is not an option.

Is there no terminal commands, just 3rd party software that can potentially achieve this search is that the overall feeling?

Thank you everyone for your input.

Probably quite a rare problem, cheers.

 

[MacInWin]

I can move the TM files to a USB drive, however I don't want to break the TM data I have until issue resolved.

Unfortunately backups go back to Jan 2018 and these file(s) can change multiple times per day, therefore scrolling is not an option.

Is there no terminal commands, just 3rd party software that can potentially achieve this search is that the overall feeling?

No, don't try to move the TM files. They are not normal files and have special attributes that means that if you try to use any "normal" tools to mess with them you will break the backup integrity and have to start all over from scratch.

I thought I understood your objective but I'm not clear any more. You said:

The device has a Time Machine backup and I would like to search the backups for all instances of this file and sort by date modified and / or filesize.

Scrolling back in TM will quickly show you if the date/filesize has changed. You only need to find ONE instance to know it's happening. What does the "sort" achieve for you? If the files are not static, and are actually changing, there is no way to know whether the change is what you initiated or if this errant program is doing it. And finding the largest size won't necessarily be the "best" version of the file.

In addition, TM deletes and aggregates older files. It keeps hourly files for 24 hours, then daily for a moth and then weekly for older. So the "largest' may well have been eliminated in that aggregation process. Here is what Apple says here: Back up your Mac with Time Machine

• Time Machine automatically makes hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months. The oldest backups are deleted when your backup disk is full. The first backup might take a long time, but you can continue using your Mac while a backup is underway. Time Machine backs up only the files that changed since the previous backup, so future backups will be faster.

I don't know about Randy's tool, but the challenge is that backups on a network drive are stored as a sparsebundle file, with all extra space compressed out. Think of a zip file, although it's not actually done the same way. So no tool that opens files to search for things will work to open the sparsebundle. TM opens the sparsebundle and shows it as you would expect, which is why you have to use that tool and why you cannot just get into it with any other tools safely.

 

[J10000]

Ok my mistake, I was under the impression that time machine stores different versions of files when they change and deletes old versions only when space / capacity is required (when the backup disk is full).

To understand my problem...

It is essentially a music program that I use that can program tracklists / playlists (or crates) of a selection of songs / tracks and unfortunately it appears to be 'an errant program' and loses this data from the files sporadically (however the program is essential). I have been able to locate some previous crates manually, however it is impossible without some sort of search functionality to do this without painstaking hours of searching.

I have never had capacity issues with backup drive and so I thought it would have kept all old files that changed (this is a dedicated machine to this program and the only data stored or that changes is from this program) and therefore I figured that if I just found the largest filesize of a specific filename (crate) it would have the most of my songs in it that I was looking for and save me untold time.

Hopefully that all makes sense, please don't hesitate if anything else unclear.

Thank you again for all your help and advice, cheers.

 

[MacInWin]

It does. But the search isn't likely to be that hard. Find where the file is on your current drive, then with Finder there, Enter Time Machine. The Finder-like image there may well be in that same folder already, but if it's not, navigate to that same place and start going back through the history. The good news is that the total number you have to check will be relatively small. Just 24 for the last day, then 30 more for the last month, and then just 52 each year. So not thousands. And you want just the size, to get to the largest. So before you Enter TM, get what you want to see in the folder in your internal drive and when you Enter TM, those same options should be in the Finder-like presentation of TM. Given you just need to check size, looking for the largest, it shouldn't be that arduous. A few minutes, maybe 30, tops. if you scroll at one every 5 seconds, that's 12 in a minute. You have about 150 copies to check, so let's call that 15 minutes. PITA but not hours of study...