3

I am looking for a specific file starting with "Screenshot 2019-07-11" with an unknown location in a Time Machine backup. I tried:

$ sudo find /Volumes/TimeMachine/ -type f -name 'Screenshot 2019-07-11*'
find: /Volumes/TimeMachine//.Spotlight-V100: Operation not permitted
find: /Volumes/TimeMachine//Backups.backupdb: Operation not permitted

The error led me to this thread, which uses bypass to execute a command, so I tried this command and got the same error:

$ sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass find /Volumes/TimeMachine/ -type f -name 'Screenshot 2019-07-11*'
find: /Volumes/TimeMachine//.Spotlight-V100: Operation not permitted
find: /Volumes/TimeMachine//Backups.backupdb: Operation not permitted

How can I search for a file in a Time Machine backup with the command line?

  • What version of macOS are you using? -- When I want to use the find command on my Time Machine backup, on macOS High Sierra, I literally use the following command when targeting something that would be within my Home folder. e.g.: find /Volumes/*/Backups.backupdb/*/*/Macintosh\ HD/Users/$USER -type f -iname 'Screen Shot 2019-10-07*' I do not need to use sudo, or other commands, and it works as is, going directly to all the backups of my Home folder without the needless searching of everything outside of it. It's much faster this way too! – user3439894 Nov 1 at 16:45
  • I'm on macOS Mojave. That command fails with find: /Volumes/*/Backups.backupdb/*/*/Macintosh HD/Users/<username>: No such file or directory (where <username> is my actual username). Even cd'ing into Backups.backupdb, I get: ls: .: Operation not permitted, without or with sudo. I believe that is why I needed bypass. Running it with your command afterwards, I still get find: .: Operation not permitted. – miguelmorin Nov 1 at 18:08
  • 1
    I guess something has changed with Time Machine backups between macOS High Sierra and macOS Mojave. Can't say for sure as I do not have a Time Machine backup on my macOS Mojave system, however, you might have to add Terminal to Full Disk Access in System Preferences > Security & Privacy > Privacy for it to work. Also, you do not have a backslash to escape the space in Macintosh HD, e.g.: Macintosh\ HD – user3439894 Nov 1 at 18:15
  • Thanks for the answer. I had a backslash to escape the space when running the command (find /Volumes/*/Backups.backupdb/*/*/Macintosh\ HD/Users/$USER), but the error message does not escape the space (find: /Volumes/*/Backups.backupdb/*/*/Macintosh HD/Users/<username>). – miguelmorin Nov 2 at 9:30
  • If my edit is accepted, it encompasses all these comments. How about we delete them all? – miguelmorin Nov 2 at 9:31
1

In order to access a Time Machine backup from Terminal on macOS Mojave, and later, you'll need to add Terminal to Full Disk Access in System Preferences > Security & Privacy > Privacy for it to work.

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .