Time machine does not back up files after computer crash - only aliases

The problem is that you aren't using Time Machine to retrieve the files, since you are now in Tiger. When Time Machine makes the first backup it copies all the files to the drive. At each subsequent backup it consults a log file telling it what files have been changed since the last backup, and then it copies those files, and those files only, to the backup folder for that date/time. All other files that appear when you open the sequential backup folder are hard links to the files in the original backup folder, rather than the files themselves. Hard links are rather interesting beasts: the Finder interprets them as an alias, but they aren't. Not exactly. As you probably know, when you trash something normally and empty the trash the data is still on the disk, but the "pointer" to the data is removed, so the data can be over-written, and an alias will no longer work, since it pointed to the directory entry. What a hard link is, is another "pointer" to the same data as the original, so if you remove the original directory entry by trashing it, the hard link should still work since it continues to point to the original data, not to the original directory entry for the data, as an alias does. Apple evidently had to do some fancy fixes to use this method in Time Machine and avoid the horror of infinite loops, while keeping the ability to avoid creating grossly huge backups.

I haven't tried using my Time Machine volume in Tiger, so don't know what it would look like there. You might try opening the very first folder created and see if items there show up as "real" files. But it sounds to me like you may have gotten some damage to the backup drive. In Leopard I can open the various Time Machine backups in Finder and copy a file to my Desktop and it copies the "real" file to the Desktop (as it ought) even though what I'm dragging is actually a hard link to the data on the disk. That is, it doesn't matter whether I drag the file from the very first backup or the most recent backup, the file gets copied either way.

It is not clear to me exactly what you are seeing when you open the Time Machine drive. My computer is named "Noobix" and the startup drive backed up on the TM drive is named "Leopard" while the Time Machine drive itself is named "Time"-- and this is the path to the first backup of the Applications folder:

"/Volumes/Time/Backups.backupdb/NoobiX/2007-11-08-054356/Leopard/Applications"

Here's the path to the most recent backup:

"/Volumes/Time/Backups.backupdb/NoobiX/2007-11-23-173818/Leopard/Applications"

The "Noobix" folder inside the "Backups.backupdb" has a separate sub-folder for each instance of a Time Machine backup, plus an alias called "Latest" which points to the most recent backup. If you aren't seeing something like that then you have a problem. If Finder is still showing 30GBs then the data is still there, but you may need to use Terminal to "see" it and get it back.
Francine


Francine
Schwieder

OK, I just rebooted into Tiger and am looking at the Time drive. It appears that nearly all folders in the actual backup appear as aliases, including things that one would not usually see as folders in the Finder (such as an application, like iMovie for instance). However it is perfectly possible to follow the alias links down to the level where one gets to actual files, and then to copy the file into Tiger. When I get to a file and copy it, all seems perfectly fine.

Thus, I open the Time drive and see a folder "Backups.backupdd" and open it. There is a folder "Noobix" which when opened shows the folders for the dated backups. Opening the first one shows the Leopard folder--so far everything is the same as in Leopard. But when I open the Leopard folder all the sub-folders, except Users and Library, are aliases. If I click the alias for Applications, I see aliases to all the applications, click their aliases, and I finally get to "real" folders and files.

Looking at this in Terminal I see the same thing: only Library and Users show as directories (folders), everything else is a file (an alias). If I wanted to get something out of my home folder on the Time Machine backup, I can do so:

Open everything in order:

"/Volumes/Time/Backups.backupdb/NoobiX/2007-11-08-054356/Leopard/Users/francine"

So far, all the above are folders. Now comes the strange part--my Pictures folder shows as an alias, but I can open it, then the sub-folder "Summer07" (also an alias) can be opened, and inside of that are more sub-folder aliases, plus some actual files. If I drag an actual file onto the Desktop, it copies and opens in the appropriate application. Let us hope this will work, that you can follow the folder/alias trail to the actual files, and copy them, because the situation is evidently VERY different than anything I've ever seen before. I looks like the actual data may be in an invisible place: "/Volumes/Time/.HFS+ Private Directory Data" (which is locked). Terminal doesn't seem to be able to quite figure this out--here's the Terminal list entry:

dr-xr-xr-t 3735 francine francine 126990 Dec 31 1969 .HFS+ Private Directory Data?

Notice the question mark at the end? Well, when I try to get Terminal to open something in there I just get an error.

I think you should be able to easily get regular files, such as jpegs, back by following the path to them. A problem arises with things such rtf "files" or .pages files, things that appear in the Finder as files, but aren't really. They are packages, and so you see an alias instead of the file, and the alias doesn't seem to go anywhere. That's because it is pointing to something inside that invisible and locked ".HFS+ Private Directory Data" thing.

I tried to get back a Pages file: "addresses.pages"--which shows as an alias, and will not open. Doing GetInfo on the file I see that its Original is shown as being /Volumes/Time/.HFS+ Private Directory Data/dir_524743, but trying to see it in Terminal didn't work, just get "no such place" errors. So I did a Control-click on the file and selected "Show Original" and Finder opened that invisible folder, showing a huge list of "dir_xyxx" type folders. I scrolled down looking for "524743" and found it, but was dismayed to see is was showing as a blank sheet icon, not a folder icon! I tried copying it to my Desktop anyway, and on a hunch I added the original extension ".pages" to it. Double clicking does indeed open it, and it is indeed the addresses file!

So I conclude that the "real" data is actually stored in that invisible directory, and you can get it out again. For straight files like jpegs you should be able to easily just follow the yellow brick road in Finder, of folder to aliases to actual file, and copy. The situation with comples files, such as pages files, rtf files, Quicken files, applications and others like them is more complex, but it is doable. Not easily, but you can get the stuff back.
Francine


Francine
Schwieder

Trying to copy a folder alias is not going to do anything. I gather that when you click the alias for the folder, nothing happens except the error message? I'm guessing that somehow your Time Machine volume has suffered a disconnect between the aliases and the actual data location, which I think is that invisible .HFS+ folder I mentioned above. Afraid I booted back into Leopard, and what I see in both the Finder and the Terminal when looking at the Time drive is VERY different from what I see looking at it all from Tiger.

I don't know whether this will work or not (it doesn't in Leopard because there is no sign at all of the .HFS folder I see in Tiger, which is just too strange), but you could try this:

1. In Finder select the Go menu item and select "Go to Folder..."

2. Enter this: /Volumes/NameOfTimeMachineDrive/.HFS+ Private Directory Data/

3. Hit the Go button and see if you get a long list of dir_xyxx type folders

If not, well the stuff is obviously still there and perhaps someone at Apple would know how to get it back, but I sure don't. It is all very odd, even with my stuff, which is all working and hasn't gone through any crashes. Evidently yours got damaged somehow, so is in an even more bizarre state than my drive.
Francine


Francine
Schwieder

PS--I'm going to beg for some help, so maybe by tomorrow we'll know a little more. Of course, it could be there isn't anyone outside of the Apple engineers who would have any idea how this is all really working.

Message was edited by: Francine Schwieder

Can't you just boot off the Leopard install DVD and run Time Machine from there? I know you can restore an entire system that way. I'm guessing you can also restore ordinary files to whatever location you choose.

Lawrence

After I saw Francine's post about this subject I had a play around with my systems, and can't really see the difficulty.

I have my TM backup on a FW external drive, and I don't usually leave it plugged in because there are two drives used on both a Tiger and a Leopard machine.

So I plugged the chain into my G3 iBook running 10.4.11 and double clicked on the TM volume. I just followed this chain (some of these, marked with a '*', were aliases: no matter, they will eventually lead you to a "real" file): LeopardTM > Backups.backupdb > Michael Conniff's MacBook > Latest* > MacBook OSX5 > Users > michaelc > Documents* > Helper Folder > FAQ Source* > FAQUpdates. This got me to a file I updated a few days ago.

I was then able to drag this to my Desktop on the iBook and open it in TextEdit as normal.

Interestingly, behind all those aliases the actual path to that file was "/Volumes/LeopardTM/.HFS+\ Private\ Directory\ Data^M/dir_996271/FAQUpdates.rtf". That '^M' stands for a Carriage Return, which makes life interesting if you try to access the directory using Terminal 🙂

If you don't want the "Latest", choose the folder with the appropriate date from the folder corresponding to your computer name. For example, if I wanted the version of the above file before I modified it, I could choose "2007-11-22-230019" instead of "Latest".

Try it and see, and post back if you have difficulty! If it doesn't work for you, please describe exactly your setup, how you are attaching the backup drive, etc, as I tried to do above.

Hi Lawrence, I'm booted into Tiger and trying to get the files. Evidently Michael's machines are behaving the same way mine does, which is not at all like yours. Something somehow seems to have damaged the connection between the alias files and the invisible folder where the data is actually stored on your machine. From the 30GB size I'm convinced the stuff is still there, even though the links are broken. I've got two ideas:

1. Launch Terminal from your Utilities folder
2. Type "open" and then a space, then drag your icon for your TimeMachine drive into the Terminal window and drop it. Depending on the name of the drive (mine is just named Time), you'll see something like this:

Tigin:~ francine$ open /Volumes/Time/

There should be a space after the final slash, which we don't want, so hit the delete key so the text insertion is immediately after that slash.

Next type
.HFS+

and hit the Tab key (be sure to type the leading period!). With any luck at all Terminal will fill in the rest of the name, including that dang carriage return--IF the folder is still available. You would end up with something that looks like this:

Tigin:~ francine$ open /Volumes/Time/.HFS+\ Private\ Directory\ Data^M/

3. Now press the Return key, and it should open a Finder window displaying all those "dir_xyz" folders. Some of them contain actual files, most contain other aliases, but perhaps once you are inside the actual data store those aliases will work.

If the Terminal can't locate the directory, I suppose you could try doing a disk repair using Disk Utility, although the gods alone know what would happen to the Leopard Time Machine drive if you tried to repair it with the Tiger Disk Utility. Well, Michael might know, but I wouldn't hazard even a guess.
Francine


Francine
Schwieder

Francine Schwieder wrote:
Next type
.HFS+

and hit the Tab key (be sure to type the leading period!). With any luck at all Terminal will fill in the rest of the name, including that dang carriage return--IF the folder is still available. You would end up with something that looks like this:

Unfortunately, although this works, the Terminal acts on this carriage return, which will leave you very confused (if you're not already 😟 ). It looks something like this:

ibook:/Volumes/LeopardTM michaelc$ cd .HFS+ Private Directory Data^M/
 michaelc$ mes/LeopardTM/.HFS+ Private Directory Data
 michaelc$ ls -alopardTM/.HFS+ Private Directory Data
total 0
…

where that directory name, being part of the prompt, is repeated each time. You may be lucky and not get this, but if you do, copy and paste this:

PS1="h:u$ "

and press return, which will remove the directory name from your prompt, just for the duration of this shell session.

I have stuff to do, so won't be able to post back for a few hours. But try the rest of Francine's post and see how you get on. Something seems wrong if that alias is pointing back at your boot volume, which seems possible given the message you're getting. But your files are there—we'll get to them!

Lawrence, glad it worked!

but I will do double backups in the future.

When I got my first Mac in 1994 my brother, who has worked with computers since the mid 1960s (he was a kid, and built his own), told me I HAD to have at least three copies of every file that was important, preferably on 3 different media. These days I interpret that as three different drives, plus periodically burning my own data files to CDs and DVDs. Nothing like a good scare to get one's attention. BTW, in the course of figuring out what you might do I was talking to him, and he said something like "Time Machine isn't your only backup is it?" Which reminded me it had been over a week since I updated my clone. 😉
Francine


Francine
Schwieder