I barely used my computer, yet I noticed that Time Machine transferred 2.7G worth of data.. immediately after I ran following:

mbp:~ alexus$ time tmutil compare
- 181B                          /Volumes/Time Machine Backups/Backups.backupdb/mbp/2013-06-24-124026/Macintosh HD/.com.apple.backupd.mvlist.plist
!         (mtime)               /Library/Application Support/Norton Solutions Support/Scheduler/SchedulerAux/com.symantec.symsched
!         (mtime)               /Library/Caches
!         (mtime)               /Library/Preferences
! 4.5K    (mtime)               /Library/Preferences/com.apple.TimeMachine.plist
!         (mtime)               /System/Library/Caches
! 10.5K   (size, mtime)         /Users/alexus/.bash_history
!         (mtime)               /Users/alexus/Dropbox/1Password.agilekeychain
! 512.4K  (mtime)               /Users/alexus/Library/Application Support/Google/Chrome/Default/GPUCache/index
!         (mtime)               /Users/alexus/Library/Calendars
! 2.1K    (mtime)               /Users/alexus/Library/Calendars/11367463-CB25-4E29-A258-A374E54A1ADD.caldav/Info.plist
! 3.2K    (mtime)               /Users/alexus/Library/Calendars/1245EE97-E221-42E3-B4AC-FE15BB0B9E38.caldav/Info.plist
!         (mtime)               /Users/alexus/Library/Preferences
! 856B    (mtime)               /Users/alexus/Library/Preferences/at.obdev.LittleSnitchNetworkMonitor.plist
!         (mtime)               /Volumes
!         (mtime)               /private/tmp
!         (mtime)               /private/var/db
! 1.4K    (size, mtime)         /private/var/db/.TimeMachine.Results.plist
!         (mtime)               /private/var/db/ConfigurationProfiles/Setup
! 3.0K    (mtime)               /private/var/db/com.apple.TimeMachine.SnapshotDates.plist
!         (mtime)               /private/var/db/mds/messages
! 32.0K   (mtime)               /private/var/db/mds/messages/se_SecurityMessages
!         (mtime)               /private/var/db/mds/system
! 0B      (mtime)               /private/var/db/mds/system/.fl8E6EFC6C
! 0B      (mtime)               /private/var/db/mds/system/.flCF600F4B
! 0B      (mtime)               /private/var/db/mds/system/mds.lock
! 49.6K   (mtime)               /private/var/db/mds/system/mdsDirectory.db
! 4.5K    (mtime)               /private/var/db/mds/system/mdsObject.db
!         (mtime)               /private/var/rpc/ncacn_np
+ 0B                            /private/var/rpc/ncacn_np/lsarpc
+ 0B                            /private/var/rpc/ncacn_np/mdssvc
+ 0B                            /private/var/rpc/ncacn_np/srvsvc
+ 0B                            /private/var/rpc/ncacn_np/wkssvc
!         (mtime)               /private/var/rpc/ncalrpc
+ 0B                            /private/var/rpc/ncalrpc/NETLOGON
+ 0B                            /private/var/rpc/ncalrpc/lsarpc
+ 0B                            /private/var/rpc/ncalrpc/srvsvc
+ 0B                            /private/var/rpc/ncalrpc/wkssvc

Added:         0B
Removed:       181B
Changed:       623.9K

real    15m4.257s
user    0m56.826s
sys 2m7.513s
mbp:~ alexus$ 

Why did it say 2.7G then??


1 Answer 1


The tmutil compare command compares your current file tree with the most recent Time Machine backup. Time Machine makes a bunch of backups, though. It takes hourly snapshots, then retains daily snapshots covering the last month, and then retains weekly snapshots for all prior months. tmutil compare only uses the most recent hourly backup.

All these snapshots will remain on your backup drive until the drive starts running out of space. Then the oldest backup data is purged. Until you hard drive is basically full, it will continue to fill.

Most of the files shown in your comparison are things that OS X or other software fiddle with pretty frequently. You don't need to do a lot to trigger changes to those files; every login, etc. will result in changes. So, while you barely used the computer, if we're talking about a long enough period of time it looks like the computer has kept itself plenty busy enough to populate 2.7G of Time Machine backup/revision data :)

Updated to answer question in comment below

Let's take the literal question "Where is the 2.7G that TM transfered?" The answer is: Nowhere, because TM did not transfer 2.7G.

Better question: "Why does TM show a 2.7G transfer, but tmutil compare shows a 624K transfer? Why are these two numbers not in agreement?" Strictly speaking, TM isn't showing a 2.7G transfer but 2.7G of something related, but different. That "something different" depends on what you're looking at.

If we are looking at the size of the Time Machine drive or sparsebundle, those contain multiple backups. If we are looking at the drop-down menu from the TM menubar icon during a transfer, that shows the full size of files involved in the transfer and not the size of the transfer itself. TM figures out which files have been updated since the last backup, and then sums the full sizes of these files to provide a rough progress report in the drop-down menu (like a textual "progress bar," if you will). Where possible, TM transfers the updated parts of those files instead of the full files (to avoid duplication of data, and to speed the backup process).

If "TM shows" you 2.7G somewhere else, we'd have to know where that somewhere else is before being able to answer this question. Screenshot, perhaps?

  • tmutil compare should've reflect that 2.7G that TM showed me while doing backup in the output, yet according to that output not much was done, so where is 2.7G that TM showed me before?!
    – alexus
    Jun 25, 2013 at 3:32
  • Didn't have room to explain in comments, so I tried to address this question in an update to the answer itself. Also: It might be better to stick to regular punctuation, regardless of how you might be feeling about your question. "Why?" appears rational, and you are probably rational. "Why??" and "Why?!" represent panic or anger, and I doubt you're puking your guts out or blowing your top over a file transfer reporting discrepancy. Even if you were, even if you have nightmares about this, why broadcast it? Jun 26, 2013 at 22:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .