format of Time machine files

Question

Sportalcraft Author

Level 1

8 points

format of Time machine files

hello,

I have a MacBook that i backed up regularly using Time machine.

unfortunately, my laptop's drive failed and no longer bootable.

even worse, somehow, the backup drive failed simultaneously.

so I no longer have access to my data.

I sent the backup drive to a company specialize in data recovery from corrupt drives,

they believe they can recover most of the data.

since i didn't backed up the file manually, but using TM, I wanted to make sure the recovery can still succeed.

for example, if TM does not save files as is, but as a list of files describing changes (similar to 'git diff')

and they only recovered parts of those files, I might end up in a version of the file from years ago, or a corrupt unusable file.

if TM saves the files as is, than there should be no problem.

will the data recovery process succeed if the drive could not be restored entirely?

Thanks

MacBook Pro 15″

Posted on Oct 2, 2023 7:25 AM

Reply

Answer 1

Oct 2, 2023 10:09 AM in response to Sportalcraft

¿ how did you decide your backup drive had failed at the same time?

Please pardon my skepticism, but that is unlikely.

--------

Time machine stores its backup files in a normal form (unless you specified the drive should be encrypted). Files are in a folder structure similar to the original. Around that, it builds a complex database, with links to previously-stored versions of files from older backup sessions, so as not to store many copies of the exact same file. It also stores something like the Spotlight index with those files.

"Going Fishing" with Finder through that data structure is not recommended, but it can be done. When looking for a particular file, it is unlikely to be detectable in any particular backup session. The original of that file will be in its original backup session folder, and it is hard to determine what session folder that might be using Finder alone.

Because of this complexity, by far the preferred method to retrieve a few files is to use Time machine.app (not to be confused with Time Machine control panel).

...

The stack of folders in the current directory recede back, back, back in Time.

The preferred method to recover a whole userid or a whole computer is to use Migration Assistant, with the backup drive as the source.

Reply

Answer 2

Oct 2, 2023 1:54 PM in response to Sportalcraft

Your Backup SET consists of a number of Backup Sessions, ordered and named by date.

The symptom users see is that they use the Finder to open the latest backup session, and the file they seek does not appear to be present in that backup session, in the way they are used to seeing that file. Time Machine saw that it was present on an older backup session, so did not include yet another copy of the file itself, but only a Link to that file (in an earlier backup session folder).

Depending on permutations and combinations of backup software and current operating software:

• you may see nothing,

• you may see a file-like placeholder that does nothing in Finder (but might do something in Terminal),

• you may see something resembling an Alias file that will show you the file you are looking for if clicked,

• you may see the actual File, made available by automatically chasing the link and getting you the actual file in an older Backup session, seamlessly.

All would be referred as a "link to that file". Whether Finder can follow that link depends, as I have noted.

Reply

Answer 3

ku4hx

Level 7

23,694 points

Oct 2, 2023 9:43 AM in response to Sportalcraft

There is no guarantee the recovery will succeed, and if there were it would have to come from the recovery outfit.

TM files are not simply copies. They are in whatever format Apple chose and to get what that is you'll need to ask Apple. Simple copies can be accessed by Finder, but the TM dataset can be damaged by Finder so the conclusion is obvious.

The questions you're asking on what the recovery people can do is not answerable by this community.

I have always had an aversion to backup apps that required a recovery app to get the data back. TM is like that. Because of that, we now backup with Carbon Copy Cloner using their version of TM. That version DOES make simple copies that can be read directly by Finder. Or by Windows explorer is they need to be. They can also be opened directly within the backup dataset by the creating app unlike TM files.

Reply

Answer 4

Sportalcraft Author

Level 1

8 points

Oct 2, 2023 12:43 PM in response to Grant Bennet-Alder

Thank you

to answer your first question,

I wanted to erase my computer drive and restore from the backup drive (perhaps to fix a corrupt core sector),

however the partition could not be detected, I also tried from different computers, can't read it. (other partitions was readable, but the backup partition on the drive was not readable on all tested computers, was grayed out in disk utility, and could not be mounted).

i usually backup around once a week, so there was a window of 7-10 days it could have failed before my computer failed, until I noticed.

annoying, as I took preventative measures to avoid exactly this situation...

so if the recover succeed partially, there is a chance ill end up with a link to a file that was not recovered properly, so Ill need both the link, and the file to be properly recovered?

and even so, manually searching the actual file in all saved backups, and do so to all my files?

that... not what I was hoping for :(

Reply