August 25, 2008

Time Machine on Linux

tux on a time machineRecently after switching from Mac OS X to Debian, I found I needed to restore a couple files from the Time Machine backup that I kept. The drive works just fine as an HFS+ mount, but I couldn't figure out how to retrieve anything within. When Google didn't yield the answer, I began to explore on my own. Turns out Apple does a couple slick things with the file system to make incremental backups work.

For anyone that needs to access their Time Machine from something other than its associated Mac, here's how:

Mount the drive. On linux it should automount if you have gnome-volume-manager installed. If you don't see it in /media then run nautilus and check the desktop. Still don't see it? Read man mount. And then don't forget the -t hfsplus flag.

Change directory. My mount point is /media/Time Machine/. Within that path I find the directory Backups.backupdb/. This represents the directory layout of your backup system. Inside that directory is the name of your disk. Inside that are folders labeled with dates corresponding to each incremental backup that was made. Pick the one you want, or choose the Latest symlink. For example, my path is now:

/media/Time Machine/Backups.backupdb/Drive\ 1/2008-06-05-073745

Find your file's folder. Within that path is a complete representation of your filesystem. Navigate to the location of your file. If it's not too big or nested too deep, it may be plainly visible. However there's a good chance that its parent directory doesn't exist. Instead you'll see a zero-byte file for the parent that takes its name and acts as a pointer. Run ls -l and take note of the first numbered column. Example:

...
-r--r--r-- 2155704 root 5791966       0 2007-06-25 02:54 Wallpaper
-r--r--r-- 2155725 root 5791967       0 2007-06-25 02:54 Web-Identity
-r--r--r-- 5441953 root 5791968       0 2007-06-25 02:54 Windows
-r--r--r-- 5511926 root 5791969       0 2007-06-25 02:54 Work

After the permissions you'll see the directory number that typically refers to the number of directories within that folder. For a file it should always be 1. Here it is not. What Apple has done is adjust the information in this file's inode to use it as a pointer to the directory that contains the actual file. That way multiple revisions of the same drive can coexist without duplicating data.

Find the data. So in my case I want to grab something out of the Wallpaper folder. First I make a note of the directory number, 2155704 and then cd /media/Time Machine/.HFS+ Private Directory Data. This is where the data really lives. From there just cd dir_2155704 and voilà!


Comments

  1. Michael Ash clued me in a little more. Turns out Apple is just using hardlinks to connect the revisions. Unfortunately linux doesn’t allow hardlinks on directories, so the directories just show up as empty files. I imagine this could be remedied in the hfs plus module, probably at the very least for read-only filesystems.

  2. Your assumption:

    /media/Time Machine/Backups.backupdb/Drive 1/2008-06-05-073

    is partially wrong. The portion after /Backups.backupdb/ is not the “DriveName” but rather the “ComputerName”, which includes the time stamped snapshot(s), and then on the lowest hierarchical level, the Volume(s) of Computer Name. A “Volume” is Mac terminology for “disk partition.”

    So structure rather is:

    /Backups.backupdb/ComputerName/YYYY-MM-DD-hhmmss/Volume1
    /Backups.backupdb/ComputerName/YYYY-MM-DD-hhmmss/Volume2

    Read in detail at:
    Mac OS X 10.5 Leopard: the Ars Technica review

  3. I can’t seem to get number 4 to work with the command “cd /media/Time Machine/.HFS+ Private Data Directory”. It says file or directory not found. What exactly is the “.HFS+” command? I see every thing else but I don’t see that directory. Can anyone help?

  4. .HFS+ isn’t a command, it’s part of a directory path. You probably can’t see it because dot-files (those beginning with ‘.’) are usually hidden from view. Try ls -la to view all the files in the directory, and then use cd and tab-completion to navigate into the folder. I hope that helps.