15

I am looking for a specific file starting with "Screenshot 2019-07-11" with an unknown location in a Time Machine backup. I tried:

$ sudo find /Volumes/TimeMachine/ -type f -name 'Screenshot 2019-07-11*'
find: /Volumes/TimeMachine//.Spotlight-V100: Operation not permitted
find: /Volumes/TimeMachine//Backups.backupdb: Operation not permitted

The error led me to this thread, which uses bypass to execute a command, so I tried this command and got the same error:

$ sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass find /Volumes/TimeMachine/ -type f -name 'Screenshot 2019-07-11*'
find: /Volumes/TimeMachine//.Spotlight-V100: Operation not permitted
find: /Volumes/TimeMachine//Backups.backupdb: Operation not permitted

How can I search for a file in a Time Machine backup with the command line?

Improve this question
7
  • What version of macOS are you using? -- When I want to use the find command on my Time Machine backup, on macOS High Sierra, I literally use the following command when targeting something that would be within my Home folder. e.g.: find /Volumes/*/Backups.backupdb/*/*/Macintosh\ HD/Users/$USER -type f -iname 'Screen Shot 2019-10-07*' I do not need to use sudo, or other commands, and it works as is, going directly to all the backups of my Home folder without the needless searching of everything outside of it. It's much faster this way too!
    – user3439894
    Nov 1, 2019 at 16:45
  • I'm on macOS Mojave. That command fails with find: /Volumes/*/Backups.backupdb/*/*/Macintosh HD/Users/<username>: No such file or directory (where <username> is my actual username). Even cd'ing into Backups.backupdb, I get: ls: .: Operation not permitted, without or with sudo. I believe that is why I needed bypass. Running it with your command afterwards, I still get find: .: Operation not permitted.
    – emonigma
    Nov 1, 2019 at 18:08
  • 1
    I guess something has changed with Time Machine backups between macOS High Sierra and macOS Mojave. Can't say for sure as I do not have a Time Machine backup on my macOS Mojave system, however, you might have to add Terminal to Full Disk Access in System Preferences > Security & Privacy > Privacy for it to work. Also, you do not have a backslash to escape the space in Macintosh HD, e.g.: Macintosh\ HD
    – user3439894
    Nov 1, 2019 at 18:15
  • Thanks for the answer. I had a backslash to escape the space when running the command (find /Volumes/*/Backups.backupdb/*/*/Macintosh\ HD/Users/$USER), but the error message does not escape the space (find: /Volumes/*/Backups.backupdb/*/*/Macintosh HD/Users/<username>).
    – emonigma
    Nov 2, 2019 at 9:30
  • If my edit is accepted, it encompasses all these comments. How about we delete them all?
    – emonigma
    Nov 2, 2019 at 9:31

1 Answer 1

Reset to default
16

In order to access a Time Machine backup from Terminal on macOS Mojave, and later, you'll need to add Terminal to Full Disk Access in System Preferences > Security & Privacy > Privacy for it to work.

enter image description here

Improve this answer
1
  • In macOS Big Sur, (11.6.3) if you try to access the Backups.backupdb folder you get a "rotten symlink" error.
    – jerlich
    Feb 9, 2022 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .