50,000 changed files found by TimeMachine?

Question

Level 2

151 points

50,000 changed files found by TimeMachine?

I have TimeMachine set to back up when I tell it to, rather than automatically, and do so regularly. I last did a TimeMachine backup on Dec. 10. On Dec. 13, when the 13.1 update arrived, I told it to do a backup. The drop-down in the menu bar said it found 50,000+ changed files. That doesn't seem reasonable for three days, so I stopped the backup. I then, from System Settings, downloaded and installed 13.1.

I've mostly been surfing the web. Is 50,000+ changed files reasonable for TimeMachine to find in three days? What might cause this?

Posted on Dec 14, 2022 12:43 AM

Reply

Answer 1

Top-ranking reply

Charles Belov Author

Level 2

151 points

Dec 19, 2022 12:32 AM in response to Charles Belov

It turns out to be complicated, or simple, depending. I'm going to post here rather than the other post since I can't speak for what is going on for the other user.

On a hunch, I checked out the man page for tmutil, and determined these steps would work to get a list of changed files:

Log in to an administrative account on the Mac
If the TimeMachine drive isn't mounted, mount it.
Open terminal
cd to the Desktop folder
Type the command

sudo tmutil compare > compare.txt

6. Press Enter

7. When prompted, type the admin password

8. Wait until done.

At that point, I had a list of all the changed files, over 600,000 of them. Only about 11,000 were in one of other of the computer's User folders.

Turns out that most of the files are in the applications folder, for instance:

/Applications/Logic Pro X.app/Contents/Resources/AppleLoopsIndex/Soulection/Hidden Treasure Acoustic Piano.loopdata

/Applications/Logic Pro X.app/Contents/Resources/AppleLoopsIndex/Soulection/Heart Felt Wah Guitar.loopdata

/Applications/Logic Pro X.app/Contents/Resources/Project Templates/Tutorials/01 Live Loops Grid.logicx/Contents/Resources/en.lproj/Art/06_RecordButton.png

I looked at those files and they all had a modified date of Dec. 7, 2022. Logic Pro was updated Dec. 14. In fact, a huge number of file changes appeared to involve just the modified time. (That said, I don't know enough about tmutil compare to know whether it actually does a byte-for-byte comparison of the file contents.)

Still doesn't explain why in the span of one week Users had 10K+ file changes, but does explain why there's a huge number of files in general. Actually, Users could probably be explained just by all the cache that builds up surfing the web for a week. So it might be good to clear browser caches before doing a backup.

Anyway, it doesn't look suspicious (although it doesn't guarantee something suspicious isn't also going on).

Reply

Answer 2

Charles Belov Author

Level 2

151 points

Dec 14, 2022 10:20 AM in response to Owl-53

@P. Phillips, thank you. It does seem related. The other poster doesn't mention the time period; mine was only 3 days, thus my suspicion.

In the menu bar, there is a TimeMachine icon (you may need to add this to the menu bar in System Settings).

Steps:

Click TimeMachine icon in Menu Bar

Choose Back up now

Click TimeMachine icon in Menu Bar

Watch the comment in that menu immediately below the menu bar.

The number of changed files found counts up, then stalls. I am guessing (only a guess) that at that point it is done counting the changes and is preparing for the next step.

Reply