What are ".com.apple.backupd.mdmv" files for and which tool creates them?

Question

I am comparing on macOS El Capitan via diff -r a directory with a the corresponding directory of a time machine snapshot (Note: the backup is made under macOS High Sierra.)

diff reports a few files which are only present on the backup: The filenames all start with

.com.apple.backupd.mdmv

(followed by some numbers). The files are XML text files.

I searched for these files via Google, but couldn't find much about them (the only (weak) reference I found was "MDM" - Apple's Mobile Device Management - But I though this is just an iOS thing).

Which tool creates these files and why? Also, I assume I can ignore these files when checking the backup - is this correct?

Answer 1

They're generated by backupd which is the main process for Time Machine for handling backups. The files themselves track items that have been moved or renamed, to prevent them from being backed up multiple times, and to track a file's history no matter how much you move it around.

I can't find a reference to what mdmv stands for exactly, but I'm confident it has nothing to do with Mobile Device Management; my best guess would be that it stands for something like "MetaData MoVed", rather than a proper acronym.

As for the file's content, it's actually fairly straightforward. For example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>DateStarted</key>
        <date>2020-07-09T21:00:07Z</date>
        <key>FileID</key>
        <integer>174035141</integer>
        <key>NameSpaceID</key>
        <integer>2140396991</integer>
        <key>NewPath</key>
        <string>Movies/TV/TV Shows/Vikings/Season 5/02 The Departed.mp4</string>
        <key>SourcePath</key>
        <string>Movies/TV/TV Shows/Vikings/Season 5/2 The Departed.mp4</string>
</dict>
</plist>

This has the following important elements:

• DateStarted: Appears to be the time that the move was detected (presumably by fseventsd which is the process that tracks file system events)
• FileID: Seems to be a unique ID for a file, it doesn't appear to be an inode number so is likely specific to Time Machine.
• NewPath: This is the current location of the file, or at least where the file was located the last time that Time Machine was run.
• SourcePath: This is where the file was previously located, probably in reference to its location when Time Machine ran before last.

In this example, I have an episode from the TV Show Vikings which was stored under the name 2 Departed.mp4 but was renamed (by consolidating my library in TV.app) to 02 Departed.mp4.

When Time Machine was new, this would have been enough for it to see 02 Departed.mp4 as an all-new file and create a full new copy, wasting a load of space on my Time Machine disk, however over the years Time Machine has gotten a bit smarter and no longer does that.

I'd actually never encountered these specific mdmv files myself until today, which is how I found your question, but Time Machine has had an "events database" for a while now which also seems to track these kinds of changes, if you look at hidden files inside a backup directory (e.g- /Volumes/Backup/Backups.backupdb/My Mac/Latest) then you'll find one or more .eventdb files, and probably a .clonedb if any of your volumes are using APFS (they probably are if you're on macOS Mojave or later).

At a guess I expect these mdmv files are a finer-grained alternative so Time Machine doesn't have to trawl through events to figure out where a file came from. You should only see them within your Time Machine volume and nowhere else, though if you copy entire folders out of Time Machine from the Finder you may end up copying these as well by accident.