I am looking for a specific file starting with "Screenshot 2019-07-11" with an unknown location in a Time Machine backup. I tried:
$ sudo find /Volumes/TimeMachine/ -type f -name 'Screenshot 2019-07-11*'
find: /Volumes/TimeMachine//.Spotlight-V100: Operation not permitted
find: /Volumes/TimeMachine//Backups.backupdb: Operation not permitted
The error led me to this thread, which uses bypass
to execute a command, so I tried this command and got the same error:
$ sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass find /Volumes/TimeMachine/ -type f -name 'Screenshot 2019-07-11*'
find: /Volumes/TimeMachine//.Spotlight-V100: Operation not permitted
find: /Volumes/TimeMachine//Backups.backupdb: Operation not permitted
How can I search for a file in a Time Machine backup with the command line?
find
command on my Time Machine backup, on macOS High Sierra, I literally use the following command when targeting something that would be within my Home folder. e.g.:find /Volumes/*/Backups.backupdb/*/*/Macintosh\ HD/Users/$USER -type f -iname 'Screen Shot 2019-10-07*'
I do not need to usesudo
, or other commands, and it works as is, going directly to all the backups of my Home folder without the needless searching of everything outside of it. It's much faster this way too!find: /Volumes/*/Backups.backupdb/*/*/Macintosh HD/Users/<username>: No such file or directory
(where<username>
is my actual username). Evencd
'ing intoBackups.backupdb
, I get:ls: .: Operation not permitted
, without or withsudo
. I believe that is why I neededbypass
. Running it with your command afterwards, I still getfind: .: Operation not permitted
.Macintosh HD
, e.g.:Macintosh\ HD
find /Volumes/*/Backups.backupdb/*/*/Macintosh\ HD/Users/$USER
), but the error message does not escape the space (find: /Volumes/*/Backups.backupdb/*/*/Macintosh HD/Users/<username>
).