Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to know to see which files are getting backed up by my time machine? I often see a large amount of data being transfered and I'm not sure sure what it is.

share|improve this question
possible duplicate of How can I use tmutil to figure out which files just got deleted? – patrix Oct 15 '12 at 17:05
up vote 7 down vote accepted

The command tmutil compare lets you compare file lists if you don't want to do it using ls or other commands that can show differences in files and folders like rsync and many graphical diff programs.

Many people adore BackupLoupe as well. It makes a powerful database of what files are included with each backup interval.

share|improve this answer
Thanks! i'll try it out when I'm by my TimeCapsule) I think this is exactly what I was looking for)) – alexus Oct 15 '12 at 17:17
Why not edit the question a bit to make it more clear what you were wanting. It'll likely get you some up votes if you care for it and put a real title on it rather than a fragment of a phrase. – bmike Oct 15 '12 at 17:25
A zero cost alternative to BackupLoupe is TimeTracker. Does the job well enough for me. – Percival Ulysses Oct 15 '12 at 21:37

If you're interested in seeing what files are being read as the backup happens, you can use this command:

sudo opensnoop -n backupd | grep -v 'Time Machine Backups'
share|improve this answer
I get a lot of lines like dtrace: error on enabled probe ID 5 (ID 161: syscall::open:return): invalid user access in action #11 at DIF offset 24 but nothing else. – Nic Cottrell Jul 18 at 18:17

You can use timedog for that.

timedog is a Perl script that displays the set of files that were saved for any given backup created by Mac OS X Time Machine. By default it shows those files that were saved in the most recent backup. The listing includes the file sizes before and after, as well as a total file count and size. The script includes an option to summarize changes to a particular directory depth, producing a more concise display, helping to get an understanding of which areas of your system are taking up the most space in the backups. It can also sort by size, and/or omit files below a given size.

share|improve this answer
thank you, i'll check it out) – alexus Nov 26 '13 at 17:23
works well, even with AirportExpress attached storage. – YvesLeBorg Nov 22 '14 at 16:33

If you want to watch which files are being transfered in realtime you can monitor the time machine daemon with

sudo fs_usage -f -R filesys backupd

If you see abnoramly large file transfer you might see disk images from virtual machines in the list

share|improve this answer
I'm guessing you meant sudo fs_usage -f filesys -R backupd instead... I'll check it out once I connect to my home network) – alexus Jul 15 at 13:13
That throws an Can't open RAW file: No such file or directory error, the man pages have an example like this fs_usage -w -f filesys Mail – Luddig Jul 15 at 13:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.