Why does Apple TIme Machine report transferring so much data?

Question

I barely used my computer, yet I noticed that Time Machine transferred 2.7G worth of data.. immediately after I ran following:

mbp:~ alexus$ time tmutil compare
- 181B                          /Volumes/Time Machine Backups/Backups.backupdb/mbp/2013-06-24-124026/Macintosh HD/.com.apple.backupd.mvlist.plist
!         (mtime)               /Library/Application Support/Norton Solutions Support/Scheduler/SchedulerAux/com.symantec.symsched
!         (mtime)               /Library/Caches
!         (mtime)               /Library/Preferences
! 4.5K    (mtime)               /Library/Preferences/com.apple.TimeMachine.plist
!         (mtime)               /System/Library/Caches
! 10.5K   (size, mtime)         /Users/alexus/.bash_history
!         (mtime)               /Users/alexus/Dropbox/1Password.agilekeychain
! 512.4K  (mtime)               /Users/alexus/Library/Application Support/Google/Chrome/Default/GPUCache/index
!         (mtime)               /Users/alexus/Library/Calendars
! 2.1K    (mtime)               /Users/alexus/Library/Calendars/11367463-CB25-4E29-A258-A374E54A1ADD.caldav/Info.plist
! 3.2K    (mtime)               /Users/alexus/Library/Calendars/1245EE97-E221-42E3-B4AC-FE15BB0B9E38.caldav/Info.plist
!         (mtime)               /Users/alexus/Library/Preferences
! 856B    (mtime)               /Users/alexus/Library/Preferences/at.obdev.LittleSnitchNetworkMonitor.plist
!         (mtime)               /Volumes
!         (mtime)               /private/tmp
!         (mtime)               /private/var/db
! 1.4K    (size, mtime)         /private/var/db/.TimeMachine.Results.plist
!         (mtime)               /private/var/db/ConfigurationProfiles/Setup
! 3.0K    (mtime)               /private/var/db/com.apple.TimeMachine.SnapshotDates.plist
!         (mtime)               /private/var/db/mds/messages
! 32.0K   (mtime)               /private/var/db/mds/messages/se_SecurityMessages
!         (mtime)               /private/var/db/mds/system
! 0B      (mtime)               /private/var/db/mds/system/.fl8E6EFC6C
! 0B      (mtime)               /private/var/db/mds/system/.flCF600F4B
! 0B      (mtime)               /private/var/db/mds/system/mds.lock
! 49.6K   (mtime)               /private/var/db/mds/system/mdsDirectory.db
! 4.5K    (mtime)               /private/var/db/mds/system/mdsObject.db
!         (mtime)               /private/var/rpc/ncacn_np
+ 0B                            /private/var/rpc/ncacn_np/lsarpc
+ 0B                            /private/var/rpc/ncacn_np/mdssvc
+ 0B                            /private/var/rpc/ncacn_np/srvsvc
+ 0B                            /private/var/rpc/ncacn_np/wkssvc
!         (mtime)               /private/var/rpc/ncalrpc
+ 0B                            /private/var/rpc/ncalrpc/NETLOGON
+ 0B                            /private/var/rpc/ncalrpc/lsarpc
+ 0B                            /private/var/rpc/ncalrpc/srvsvc
+ 0B                            /private/var/rpc/ncalrpc/wkssvc

-------------------------------------
Added:         0B
Removed:       181B
Changed:       623.9K

real    15m4.257s
user    0m56.826s
sys 2m7.513s
mbp:~ alexus$ 

Why did it say 2.7G then??

Answer 1

The tmutil compare command compares your current file tree with the most recent Time Machine backup. Time Machine makes a bunch of backups, though. It takes hourly snapshots, then retains daily snapshots covering the last month, and then retains weekly snapshots for all prior months. tmutil compare only uses the most recent hourly backup.

All these snapshots will remain on your backup drive until the drive starts running out of space. Then the oldest backup data is purged. Until you hard drive is basically full, it will continue to fill.

Most of the files shown in your comparison are things that OS X or other software fiddle with pretty frequently. You don't need to do a lot to trigger changes to those files; every login, etc. will result in changes. So, while you barely used the computer, if we're talking about a long enough period of time it looks like the computer has kept itself plenty busy enough to populate 2.7G of Time Machine backup/revision data :)

Updated to answer question in comment below

Let's take the literal question "Where is the 2.7G that TM transfered?" The answer is: Nowhere, because TM did not transfer 2.7G.

Better question: "Why does TM show a 2.7G transfer, but tmutil compare shows a 624K transfer? Why are these two numbers not in agreement?" Strictly speaking, TM isn't showing a 2.7G transfer but 2.7G of something related, but different. That "something different" depends on what you're looking at.

If we are looking at the size of the Time Machine drive or sparsebundle, those contain multiple backups. If we are looking at the drop-down menu from the TM menubar icon during a transfer, that shows the full size of files involved in the transfer and not the size of the transfer itself. TM figures out which files have been updated since the last backup, and then sums the full sizes of these files to provide a rough progress report in the drop-down menu (like a textual "progress bar," if you will). Where possible, TM transfers the updated parts of those files instead of the full files (to avoid duplication of data, and to speed the backup process).

If "TM shows" you 2.7G somewhere else, we'd have to know where that somewhere else is before being able to answer this question. Screenshot, perhaps?