I want to restore a couple files from a time machine chronicle of backups, but I don't have the mac to restore them to.

How do I search for files within just using the folder structure


You will need an OS that can read the HFS+ filesystem. If you are running Windows, give MacDrive a try. You will have a trial period which will be plenty of time to allow you to at least pull the contents of the drive.

Once you access the Time Machine partition, look for the following directory: Backups.backupdb. In there, you will see a folder named after the machine you used to create the backups (e.g., cqm's Mac). Navigating into it will show a list of all the backups, each folder having a unique time stamp. Going into those folders will provide you with the general structure of your Mac (folders like Applications, Library, etc.). You'll want to go into Users and then your username. From there, just browse the contents and pull the files you are in need of.

Time Machine works by hard linking the files (saves space), but the general structure is identical to that of OS X. So finding things shouldn't be an issue.

enter image description here

Hard linking is a neat feature often overlooked. Unlike symlinks, which create a pointer at the OS level to the original file, hard linking actually creates a pointer at the file system level, so for all intents and purposes, they are treated as one file. Let me explain.

When a file is written to the disk, a pointer to that information is also made. When you, for example, delete something, typically the system just removes the pointer. But the data still remains on the disk. This is how recovery software works. It scans for the data and restores that pointer.

Hard linking, creates another pointer to the original data. If you remove one hard link, the other will function without problems (unlike symlinks, which are destroyed when the original file pointer is removed, resulting in a broken link). Finder won't differentiate between a real file and it's respective hard link, but you can see what files are hard linked using the ls command:

-rw-r--r--  2 cksum  staff  24806 Dec 27 12:02 icon.png
-rw-r--r--  2 cksum  staff  24806 Dec 27 12:02 icon2.png

As you can see from the above example, the "2" before the username (cksum) denotes that they are hard linked. If you created another hard link (e.g., icon3.png), that number would change to 3. Run an ls on any folder and you'll see that all the files will typically have a 1 before them. This means they are not hard linked.

As I said above, Time Machine uses hard links to cut down on the space it requires. And you can do the same. Rather than copying files or working with symlinks, it's possible to hard link content all over, and have your computer treat them as unique content. The beauty of this method is it will not inflate the data stored on your hard drive, since no new data is being written, just a new pointer.

  • 1
    thank you! I am making progress, this hard linking thing is kind of cool – cqm Mar 21 '12 at 0:06
  • 1
    @cqm You are very welcome. Glad it helped. Hard linking is neat. I will modify my answer to include a bit more about it for you. – user10355 Mar 21 '12 at 0:23
  • This seems out of date or maybe Time Machine has other modes. My time machine backup has 4 .plist files, 2 .bckup files, a file called token and then a folder calls bands inside which are tons of files with 1 to 5 character hexadecimal names. – gman Jul 12 '19 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .