Time Machine deletes old backups and makes huge new ones

Question

Time Machine deletes old backups and makes huge new ones

Time Machine wipes itself every couple of days.

I've been having this problem for several months now. Once or twice a week Time Machine will start a huge 20 hours long backup after which only the last 5-6 days are preserved and all the old backups are being wiped out. It started happening after I upgraded to Tahoe, but I've also introduced some other changes to the system and I have hard time identifying the cause.

I'm using Mac Mini M4 with 24GB of RAM, 512GB SSD, and 2GB external SSD connected. The time Machine disk is a regular 4TB HDD connected directly to the iMac. I'm keeping the system updated - currently it is Tahoe 26.5.1.
The internal disk has some 180GB free. Two big chunks of data is the system data (over 70GB) and the Apple Books (also about 70GB). The later is mostly an archive of books I read on my iPad, so other than downloading new purchases, it doesn't change much.
The most accessed large files on the internal disk are DevonThink databases - the biggest is 10GB and altogether they come up to slightly above 17GB - not big enough to cause huge backups, even though I'm using DevonThink daily.
The external drive holds my music library and the archives of the less accessed data. The Music folder is the area where I made the biggest changes before the backup issues have started - Because I own a lot of DRM-Free music and use non-apple DAP, I've decided to make my life a bit easier and separate once-integrated music Library. Now I have the regular Music Library folder, which holds Apple Music downloads unplayable on my DAP, and another folder with all the DRM-free music. The later is still added to the Apple Music.app and accessible without any issues - only the location of the files is different.
I've tried to exclude from Time Machine all the cache-folders and such. Currently I exclude from backups:

- /private/var/vm
- ~/Library/Caches
- ~/Library/CloudStorage
- The Time Machine disk itself
- A folder for temporary storage of files on the external drive.

Since I do use Apple Music daily, I suspect the Apple Music may be touching all the music files in the external folder, but even then it's slightly below 300GB of music and the huge backups that overwrite my entire backup history seem to contain all the local data I own (altogether it's about 1.5 TB and that's the size of the backup).

I've already tried:

Wiping the Time Machine disk clean (reformat), checking it with disk utility for errors - it seems to be fine.
Deleting Time Machine preferences.
Cleaning the caches and repairing access permissions with ONYX.

I lack the expertise to analyze the logs myself, butThe Time Machine Mechanic doesn't show any errors. The Storage display in System Preferences shows the DevonThink databases to be the largest files accessed lately, which is correct - they are still not big enough to cause the issue.

The only cloud disk I use, other than iCloud, is OneDisk. I believe I excluded its files from the Time Machine Backup, so it shouldn't be causing the problems.

I'd greatly appreciate any help with diagnosing the cause of the issue. Is there anything I should look for in the logs? Perhaps a software to verify the integrity of Time Machine databases? Or perhaps there is a way to reset the Time Machine once and for good, so that it returns to normal behavior?

Mac mini, macOS 26.5

Posted on Jun 14, 2026 5:39 PM

Reply

Answer 1

Top-ranking reply

woodmeister50

Level 7

21,873 points

Jun 15, 2026 4:58 AM in response to Krzysztof Zabko-Potopowicz

One thing to try, first start by tracking daily disk activity of "backup" in activity monitor. Since it is a running total, you will need to record each day's values, read and particularly write, and subtract from the previous day. A simple Numbers or Excel spreadsheet can easily be set up for this.

This will establish a base line of activity and try to roughly compare the results to the amount of changes you made during the day. If the backupd shows a lot more activity than what you believe you have changed the next step I would take is to exclude the external drive from Time Machine backups and continue to monitor backupd activity. This is a process of elimination as to what could be the source. Note that you will need make alternate backups of any irreplaceable data on that drive. You may only need to do this for a day or two if backupd if its daily activity drops dramatically.

If no change in backupd activity after doing this, then try to exclude your internal drive and monitor results as the previous test.

If either of the above have a huge effect, then you may need to narrow things down by excluding individual folders to try and find the "trigger".

If neither of the above tests causes any change, then there could be a corrupted Time Machine database file or preference that may be causing Time Machine to make excessive changes. But worry about that if it comes to that.

Side note, any reboot or shutdown will reset Activity Monitor statistics so you will need to account for that in your tracking.

Reply

Answer 2

Nov 7, 2026 2:45 AM in response to Krzysztof Zabko-Potopowicz

Just showing up to post a follow up and the resolution.

I've been following the backups for over 2 months without much success. It was obvious that the Time Machine is being triggered by something on the external drive, but I couldn't pin-point any application I use. It'd just happen to wipe the entire backup and start anew every two weeks or so.

Because of the issue I've decided to update to MacOS 27 immediately (I usually wait for .1 or even .2 before I make the jump) and after observing the issue for a couple of months I can say with certainty - MacOS 27 has fixed the problem permanently. The oldest backup is now from the 26th of August and it hasn't been reset even once since the installation of MacOS 27.

Reply

Answer 3

Jun 19, 2026 5:32 AM in response to Krzysztof Zabko-Potopowicz

Hi Krzysztof

A possible way to identify if/which large files are repeatedly re-backing up is to get Carbon Copy Cloner (you can trial it for a month?)

That can do a backups of your data (as much and as little as you wish), as TM does.

Either create a new volume on your existing backup hard drive or use a separate hard drive for this CCC backup.

Choose the option “SafetyNet on”. This will create a folder on your backup drive after subsequent runs (including of course the backup) and it will contain all things that have changed since the last backup.

Set the backup to go every hour and after a time have a look at the CCC-SafetyNet folder to see if you can spot anything that might be causing your troubles with TM.

Reply

Answer 4

MrHoffman

Level 10

168,883 points

Jun 14, 2026 6:38 PM in response to Krzysztof Zabko-Potopowicz

How is the disk connected? USB direct-wired? Via a USB hub? Otherwise?

Does DriveDx or similar tool report any disk storage errors?

Please download and run EtreCheck (the free version, don’t need the paid version here), and share the results to the clipboard. Then open a new reply here, and press the Additional Text button that looks like a printed page, and paste and post the hardware and software configuration report here. From that, we can get a little more detail about what is installed and what is running here.

Reply

Answer 5

Owl-53

Level 10

123,295 points

Jun 15, 2026 2:06 AM in response to Krzysztof Zabko-Potopowicz

Just one point to be made

BitdefenderVirusScanner.app

BitDefender - Causes my iMac to crash

Is Bitdefender needed or of any use?

Bitdefender

https://support.bombich.com/hc/en-us/articles/20686461466391-Antivirus-software-may-interfere-with-a-backup

Although Carbon Copy Cloner is not Time Machine Backup from Apple

The principle of backing up to an external drive is about the same

"Some antivirus applications may prevent CCC from reading certain files, mounting or unmounting disk image files, or, in general, degrade the performance of your backup. In some cases, antivirus applications can even affect the modification date of files that CCC has copied, which will cause CCC to recopy those files every time as if they have substantively changed. In another case, we have seen such software create massive cache files on the startup disk during a backup, so much so that the startup disk became full. We recommend that you temporarily disable security software installed on your Mac (e.g. for the duration of your backup task) if problems such as these arise. "

Third Party Security Software

There are no known Windows-like Viruses in the wild that self replicate and affect macOS, because of the underling UNIX Foundation and Permission Limitation.

The Operating System resides in a Sealed and Read Only Volume that cannot be opened by the User nor by Third Party Applications.

The Only thing this Antivirus software is protecting is the Bank Account of the Developers and for zero return to the User aside from the problems this software creates.

Mac app security enhancements

The Built in Security is all that is required to protect the computer.

Protecting against malware in macOS

Reply

Answer 6

Barney-15E

Level 10

125,828 points

Jun 15, 2026 6:22 AM in response to Krzysztof Zabko-Potopowicz

Most of the folders you’ve added to the exclusion list are not backed up by Time Machine at all. Cloud storage might be the only one that is actually backed up. Do you not care about the data you store in the cloud?

However, I doubt that would be causing your problems. I guess would be. It’s something you have installed that is causing Time Machine to make a full backup every time. I have no idea what that might be. The way Time Machine finds changed files is through the FSEvents database. macOS logs all file system events in that database and Time Machine uses it to see what has changed since the last backup. My guess is something you have installed is corrupting that database somehow or blocking access to it by Time Machine. Are you backing up at least every 10 days or less? That database does get stale and overwritten after a period of time which I don’t know exactly how large it is allowed to get if Time Machine cannot reference that database it will do a new full back up.

I just saw the log and it indicates all of your backups we’re not full backups.

Reply

Answer 7

MrHoffman

Level 10

168,883 points

Jun 15, 2026 8:12 AM in response to Krzysztof Zabko-Potopowicz

Krzysztof Zabko-Potopowicz wrote:

I'm aware Bit Defender is more or less unnecessary, but every now and then one of the organizations that gives me remote access to their network requires me to prove I do have anti-virus software installed.

You’re running macOS 26.5.1, which has anti-malware built in, and which is always enabled.

XProtect is known to prevent add-on anti-malware from corrupting macOS, too.

I would think it doesn't affect Time Machine simply because it is not running most of the time - once or twice per month maybe.

Conversely, I would suspect add-on anti-malware to cause issues, and would remove it and revert to the built-in and test again.

Reply

Answer 8

Jun 17, 2026 7:53 PM in response to Krzysztof Zabko-Potopowicz

After two days of normal activity, the huge backup happened again, so I've decided to post an update.

First, since it was a point of contention and somewhat a distraction from the main issue, I've uninstalled the Bit Defender, making sure there are no leftovers.

I've started recording daily backupd activity, as advised. On the first two days Mac Mini has been shut down for 5-6 hours, but it was either in use or sleeping the rest of the time:

The big backup started around 11 am on 17th and took all the time till the early morning of the 18th. It actually crashed once - the Time Machine drive has beed unmounted (with the "improperly disconnected" error notification from Finder) and I had to remount it manually for the backup to restart. It's the first time ever it happened, but the backup finished without any errors.

After the previous "big" backup (on 15th) my Time Machine was storing backups for 10th of June to 16th. As I said before, it is a 4TB USB3 drive and my system stores around 1.5 TB of data. It used to store many months of backup history before the problems started earlier this year.

After the latest big backup (on 18th) it stores history from 13th of June till 18th of June - roughly 5 days and I have to add all the backups in-between of these big multi-hour sessions are really small.

I think it is only the external drive that gets backed up fresh every few days. Internal drive seems to work properly. I haven't conducted any experiments with disconnected drive, but this is what I see in the Time Machine Mechanic logs (attached below). The external volume's name is "Płaski ogoniec", while "Data" is the original user partition on the internal SSD. Please let me know if I'm misinterpreting them.
The only user activity on that drive would be downloading an album from Apple Music and syncing the Photos Library that also resides on the disk. The tasks responsible for these actions in Activity Monitor show a few gigabytes of activity over the period, but nowhere close to the hundreds of GBs that overwrote my old backups.

Below you'll find the most active tasks over that period. I find these to be mostly system demons.

And finally the Time Machine Mechanic log as the Additional Text:

Time Machine Mechanic's Log

Reply

Answer 9

Owl-53

Level 10

123,295 points

Jun 19, 2026 1:45 AM in response to Krzysztof Zabko-Potopowicz

Since the Builtin Time Machine Utility is presenting some many issues

Consider an Alternative

https://bombich.com

How to schedule a backup

https://support.bombich.com/hc/en-us/articles/20686475366935-CCC-SafetyNet-Temporary-protection-for-destination-content

https://support.bombich.com/hc/en-us/articles/21384579432343-SafetyNet-snapshots-vs-Backup-snapshots

Reply

Answer 10

Jun 15, 2026 1:47 AM in response to MrHoffman

Thank you for replying.

First the Time Machine HDD. As I said it is connected directly, by which I mean I'm using USB-C to Micro-USB 3.0 (the flat connector on the disk) cable and it's connected directly to one of the ports on the Mac Mini.

I've downloaded DriveDX and it shows both SSDs to be in perfect health. Checking out the HDD's SMART status seems to be not possible without installing additional drivers, but I did check the disk in the past and found no problems with it.

Bellow I'm attaching the EtreCheck report:

EtreCheck Report

Reply

Answer 11

Jun 15, 2026 3:20 AM in response to Owl-53

I'm aware Bit Defender is more or less unnecessary, but every now and then one of the organizations that gives me remote access to their network requires me to prove I do have anti-virus software installed.

I've chosen Bit Defender for that purpose, because, as far as I'm aware, it doesn't leave anything running in the background and performs scans either on schedule (which I am not using), or directly on user request (which I sometimes use when dealing with Windows-created USB sticks and such, out of courtesy for Windows users further up the chain). I'm also using the App Store version of the app, which in my understanding is less invasive (sandboxed) by definition.

I would think it doesn't affect Time Machine simply because it is not running most of the time - once or twice per month maybe.

Reply

Answer 12

John Galt

Level 10

162,694 points

Jun 15, 2026 4:40 AM in response to Krzysztof Zabko-Potopowicz

I'm aware Bit Defender is more or less unnecessary, but every now and then one of the organizations that gives me remote access to their network requires me to prove I do have anti-virus software installed.

macOS is that anti-virus software.

I would think it doesn't affect Time Machine simply because it is not running most of the time - once or twice per month maybe.

Non-Apple "anti-virus" products are specifically identified by Apple as problematic. Your Mac will never operate properly with it installed.

Rule 1 of Macs is don't install junk.

Reply

Answer 13

Owl-53

Level 10

123,295 points

Jun 15, 2026 4:59 AM in response to John Galt

John Galt wrote:

I'm aware Bit Defender is more or less unnecessary, but every now and then one of the organizations that gives me remote access to their network requires me to prove I do have anti-virus software installed.

macOS is that anti-virus software.

I would think it doesn't affect Time Machine simply because it is not running most of the time - once or twice per month maybe.

Non-Apple "anti-virus" products are specifically identified by Apple as problematic. Your Mac will never operate properly with it installed.

Rule 1 of Macs is don't install junk.

👍

Reply

Answer 14

Jun 15, 2026 5:52 AM in response to John Galt

Ok, I understand the hostility towards the unnecessary software. State institutions in some countries don't understand not needing anti-virus software.

I also think this is completely besides the point. I've installed Bit Defender from App Store years ago, it's simply sleeping in my Application folder, it doesn't run in the background, it doesn't start unless I specifically turn it on and as far as I can tell from Activity Monitor, it doesn't leave anything running when I turn it off. Even after upgrade to Tahoe the Time Machine was working correctly for a couple of months, regardless of the Bit Defender's presence.

It's only recently that the time Machine went haywire and started filling up my backup HDD every couple of days. Can it really be caused by a piece of dormant software, which was harmless up to that point?

Reply

Answer 15

Jun 15, 2026 5:59 AM in response to Krzysztof Zabko-Potopowicz

Let me also add the Log produced by The Time Machine Mechanic from the last 24 hours. It includes one "big" backup which happened overnight.

From what I can tell, the log shows it removing couple of days worth of backups to free up the space and then copying almost all of the files on my system (452 655 out of 466 406 in the backup). Why would it do that?

Time Machine log

Reply