Inside Leopard's Time Machine: Backups for the rest of us

Think backups are a bore? Think again

1 2 3 4 5 Page 5
Page 5 of 5

Under the hood


In addition to being a revolution in backups from the user and interface perspective, Time Machine tackles some new ground in terms of the underlying way that it functions. One major change from other backup software is how Time Machine interacts with and is integrated into the file system. Originally introduced in Tiger, extended attributes allow additional metadata to be stored about items in a Mac's file system. Time Machine makes use of these attributes as well as a new system process that constantly tracks changes made to any item in the file system.

This gives Time Machine a powerful speed advantage over other backup tools because it doesn't have to scan the file system and compare what it finds to a backup. It can simply request a current list of changes since the last time it performed a backup operation and then back up the related items. This results in much faster operations and is what makes the concept of performing hourly backups a reality.

Like most incremental backup tools, Time Machine copies only files that have been modified when it performs a backup. To make each backup fully browseable, it relies on file-system links to unchanged files. To the user, these links are seamless and invisible. Each backup snapshot appears as an entire backup; both changed and unchanged files can be browsed, located and restored.

This also provides a mechanism for browsing a backup set without using Time Machine (if, for instance, your backup drive is connected to a different computer, including a computer running Tiger). The backup structure appears as a folder with various folders for each backup. You can browse through the entire structure of each backup as though it were a simple folder. You can also search the backup folders using Spotlight, though it appears you must explicitly select backup folders when searching, rather than search your entire computer or even the entire backup drive.

The structure of the backups Time Machine creates follows a general rule. At the root level of the backup drive, a folder called Backups.backupdb (backupdb being the primary Unix daemon that manages Time Machine) is created. This will store all Time Machine backups made to the drive, even if they are from multiple computers. Within that folder will be a folder for each computer backing up to the drive. The name of each folder should match the Computer Name set in the Sharing pane of System Preferences.

Browsing Time Machine backups in the Finder
Browsing Time Machine backups in the Finder. (Click for larger view.)

Within each computer's folder are folders for each backup, which are named in a date/time format, such as 2007-10-26-100000 (the final section being hour, minute and second). This example would indicate a backup made on Oct. 26, 2007, at 10:00 a.m. (100000 = 10:00:00). Within the folder for each backup is a folder for each hard drive of the computer that was backed up. From the hard drive level down, you can navigate the entire file structure of all backed up items.

Note: There is also an alias named Latest in each computer's folder that automatically links to the most recently completed backup folder for that computer.

If FileVault is enabled, the structure is slightly different. Inside the computer folder will be an encrypted disk image for each FileVault user. These will appear alongside the normal backup folders, which will contain all non-FileVault data that is backed up. Inside each disk image will be a series of backup folders for the contents of that user's FileVault-protected home folder, again in the same date/time format.

Finally, it is worth mentioning that Time Machine is very smart in how it determines what to delete when a disk begins to get full. It doesn't simply delete the oldest backups and all their files. Instead, when Time Machine deletes an older backup, it deletes only the files that were unique to that backup (i.e., files that no longer exist anywhere in the file system).

Time Machine also doesn't delete just the oldest backups. While it does keep many recent backups at frequent intervals, it also keeps a range of older backups from a wide range of dates, letting you browse as far back in time as feasible. Exactly what computation goes into determining this approach isn't quite certain (and Apple may have a competitive advantage if it chooses to keep some of Time Machine's secrets close to the vest), but in early testing, it does seem an effective solution.

Bottom line


Time Machine is a powerful new feature in Leopard. It may be one of the most compelling new features added to Mac OS X in years. The interface may seem a bit over the top, but it hides a very well-thought-out and well-executed backup system.

Time Machine doesn't offer the range of backup types -- full, incremental, differential, archive, etc. -- or backup media -- CD/DVD, tape, etc. -- that many commercial and enterprise applications do, but in a way that's the point. It is intended to be a a tool for end users, the people who often don't bother setting up a backup strategy. It's intended to be simple, intuitive and easy to use. And in all of those aspects, it scores extremely highly.

Ryan Faas is a freelance writer and technology consultant specializing in Mac and multiplatform network issues. You can find more information at and can e-mail him at

What do you think about Leopard? Let us know by sending an e-mail to

Copyright © 2007 IDG Communications, Inc.

1 2 3 4 5 Page 5
Page 5 of 5
Shop Tech Products at Amazon