5

I was wondering if there's any way to see if someone did a Time Machine backup on a macbook.

  • 1
    Which problem are you trying to solve here? How long in time do you want/need to look back? – nohillside Nov 18 '19 at 14:52
7

From what I'm gathering you want to see if anyone accessed your computer to make a backup of it. I found this thread which might answer your question for how to retrieve the time machine backup logs from your Mac. Run the following command in Terminal

log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

which will show the most recent backups made. There is one change needed since log files can show activity of another account, if your Mac doesn't have your log in trusted as an administrator, you need that permission to do the search. Just add sudo to the above command as shown below:

sudo log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info
  • 2
    This command may need sudo. Without on a standard user account I get the error log: Could not open local log store: The log archive format is corrupt and cannot be read. With sudo it works. – lx07 Nov 19 '19 at 11:28
3

I think this might help:

The Time Machine Mechanic (T2M2) – a quick but thorough check of Time Machine backing up

It’s a free tool from Howard Oakley, who describes it this way:

T2M2 analyses your logs to discover whether Time Machine backups have been running normally, reporting any worrying signs or errors. You do not need to be able to read or understand logs to be able to check for problems now. Reports deep event traversals, compaction of volumes, regularity of backups, and more. Detailed Help book explains results and advises. New version enhances reporting of free space on backup volumes.

That’s where I’d start!

  • Superb recommendation. Howard's tools use the unified logging system to parse out data similar to another answer - I love that you mentioned it since it's very easy for people to use. – bmike Dec 27 '19 at 16:11
0

You can use this command:

defaults read /Library/Preferences/com.apple.TimeMachine Destinations

to read the configured backup destinations. Each entry will include a list of "SnapshotDates", showing when the Mac was backed up to that destination. Note: it won't list snapshots that have been deleted/expired, or destinations that have been removed from the configuration.

  • 1
    It will return The domain/default pair of (/Library/Preferences/com.apple.TimeMachine, Destinations) does not exist, if never backed up. – ankii Dec 27 '19 at 19:13
-1

Time Machine preferences will show you all disks used to back up the machine, and date ranges for the backup. Unless someone was particularly malicious and deleted that backup location from the MacBook prefs after completing it, you should be able to determine the date of last backup to a given drive.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .