18

I'm trying to delete all backups of specific items through the command line. I can accomplish this using the GUI through the following steps:

  1. Enter Time Machine
  2. Navigate to the file to be deleted
  3. Right click (or click the gear icon in the finder) and choose "Delete all backups of ..."

How can I replicate this on the command line using tmutil? Especially, when using Backup Loupe to detect large files it'd be easier to use the Terminal (since I don't have to enter TimeMachine at all each time I want to delete a particular file and can navigate to it using the Finder, and then drop it onto Terminal for a command to delete it).

I was hoping I could use something like this:

sudo tmutil delete /path/to/file

however it gives me the error:

"Invalid deletion target (error 22)"`

This works fine:

sudo tmutil delete /Volume/Backups.backupdb/<machinename>

and this too:

sudo tmutil delete /Volume/Backups.backupdb/<machinename>/<specificbackup>

According to man tmutil the delete command should also be able to delete specific items. However, I've been out of luck so far. While there are numerous answers on this site (and elsewhere) to delete specific backups with tmutil and to delete specific backup items through the GUI (using the method described above) I was unable to find any non-GUI way to delete specific backup items.

2
  • 1
    @stephenwade I see you added a bounty to this question, thank you :) Am I supposed to now accept an answer or are you supposed to give the bounty to someone? I'm unclear how bounties on others' questions work.
    – jan
    Apr 20, 2019 at 8:00
  • 2
    You can accept (or not accept) whichever answer you like, without impact on the bounty.
    – nohillside
    Apr 20, 2019 at 10:08

2 Answers 2

20
+50

I found this SU Q&A titled: How can I delete Time Machine files using the commandline which demonstrates a method for deleting specific files from the CLI. This answer highlighted a method that sounds like what you want:

My backup disk is full. I have a very large file (many gigabytes) that has been backed up for months. There is one physical copy of it, but many snapshots with hard links to that copy. To actually get rid of that file, I need to remove the hard link from every backup.

In that answer it was shown that one could use this method to delete a file:

$ cd /Volumes/WD\ 500G\ USB/Backups.backupdb/csm-laptop
$ ls -li */Macintosh\ HD/Users/csm/vm.img
...
2740350 -rw-r--r--@ 28 csm  staff  42949672960 Feb 17 16:12 2015-05-08-005636/Macintosh HD/Users/csm/vm.img
2740350 -rw-r--r--@ 28 csm  staff  42949672960 Feb 17 16:12 2015-05-08-015812/Macintosh HD/Users/csm/vm.img
2740350 -rw-r--r--@ 28 csm  staff  42949672960 Feb 17 16:12 2015-05-08-030036/Macintosh HD/Users/csm/vm.img
2740350 -rw-r--r--@ 28 csm  staff  42949672960 Feb 17 16:12 2015-05-08-041307/Macintosh HD/Users/csm/vm.img
2740350 -rw-r--r--@ 28 csm  staff  42949672960 Feb 17 16:12 Latest/Macintosh HD/Users/csm/vm.img

The method to delete the file uses a helper CLI tool included with Time Machine called bypass:

$ sudo bypass rm -f */Macintosh\ HD/Users/csm/vm.img

bypass's location

Since bypass is considered a helper script to Time Machine, it's location is not typically on your $PATH. Therefore you'll need to specify the full path to the executable. Additionally Apple has relocated it for different versions of macOS.

$ sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/MacOS/bypass \
    rm -rfv /Volumes/[disk]/Backups.backupdb/[path]

In 10.8 Mountain Lion, bypass moved into 'Helpers':

$ /System/Library/Extensions/TMSafetyNet.kext/Helpers/bypass

In 10.10 Yosemite, bypass moved here:

$ /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass

References

7
  • This does indeed look like what I was after. To clarify: By "removing the hard link from every backup" you mean "from every snapshot", right? And using the wildcard in the command sudo bypass rm -f */Macintosh\ HD\Users\csm\vm.img ensures that all of this is accomplished in one go?
    – jan
    Apr 20, 2019 at 8:11
  • 1
    @Jan The rm runs after cd /Volumes/DISK/Backups.backupdb/MACHINE so the wildcard will expand to all the dated folders containing the image. I've fixed a \\ - / typo in the answer though.
    – nohillside
    Apr 20, 2019 at 10:07
  • 2
    Yaaaaaasssss! I’ve been searching for this for years, will test on some less critical backups as I’m most interested in maintaining the integrity of the backup destination for ongoing backups. apple.stackexchange.com/questions/180214/…
    – bmike
    Apr 20, 2019 at 12:27
  • 2
    @bmike Please comment back and let me know what you find. I also have a few Macs that I need to do this on. Apr 21, 2019 at 11:49
  • I will @stephenwade - it might be a week or two until I have free time to test this. It seems like bypass is exactly the scalpel I need for my tool. I’d like to wrap it in swift or python so it’s easier to use, but we’ll see if I revert to the shell
    – bmike
    Apr 21, 2019 at 14:05
6

According to man tmutil, the tmutil delete command can be used to delete one or more snapshots, machine directories, or backup stores. The terms are defined at the beginning of the same man page:

  • snapshot: A directory inside a machine directory that represents a single initial or incremental backup of one computer (e.g. /Volumes/Chronoton/Backups.backupdb/thermopylae/2011-07-03-123456)
  • machine directory: A directory inside a backup store that contains all the backups for a particular computer (e.g. /Volumes/Chronoton/Backups.backupdb/thermopylae)
  • backup store: The top-level "Backups.backupdb" directory at the root of a backup disk (e.g. /Volumes/Chronoton/Backups.backupdb)

So it seems as if it is unfortunately not possible to use tmutil to delete specific items within a snapshot.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .