Time Machine Backing Up Ghost Data

[Iritscen]

Okay, maybe this is an isolated problem. I feel like I should be able to solve it, but so far I haven't been able to. Surely if it was widespread it would be talked about all over the Internet, but my searches aren't turning up anything. All right, let's cut to the chase:

Time Machine, ever since I got 10.5 (to the best of my knowledge) has been backing up 1.6GB of unknown data at least once a day, but on no discernibly regular schedule. This is unrelated to the fact that I change data on my drive all the time, and this gets backed up exactly as you would expect. The 1.6GB is on top of whatever routine stuff needs backing up. It simply seems to once in a while find 1.6GB of data that was changed, and whumph, there goes another 1.6GB on the RAID I back up on. It may be a big drive, but it will run out of space at some point, and way way way sooner than it should be running out of space as long as this continues. I am completely fed up with this problem and would have long since moved back to a previous backup scheme if that scheme allowed me to restore past iterations of files and un-delete data, which it did not. And let's face it, Time Machine is so darn cool that you want it to work even when it doesn't.

I checked the obvious large files that reside in the background while you work: Photoshop scratch disk (it's set to use the RAID right now, so it's obviously not the culprit), Parallels HDD image (I thought so at one time, but now I'm using my Boot Camp partition with Parallels, and not even booting into that partition for weeks at a time, and it still finds the 1.6GB changed almost every day or so)... I don't have any large media on the internal HD (that's what the RAID is for, if it doesn't run out of space because of Time Machine!), so I can't think of what else to look for. I saw that Time Machine keeps backup logs, but they don't list what files were backed up :-(

I realize a problem like this might be particularly hard to diagnose without being at the computer, but any ideas at all would really be appreciated.

Edit: It's also not Final Cut Express, which is set to use the RAID as the scratch disk. However, I have been in Final Cut an awful lot today, and I have seen a few or several 1.6GB backups today as well, which is unprecedented. It's rarely more than two a day. But all that's been different today is leaving FCE open, nothing else I can think of. But the 1.6GB backups occur even on days that FCE was never open.

[Satcomer]

I found if you used Disk Utility to repair the sparse image on the Time Machine disk can help. Plus I make good use of the that "Privacy" tab in the spotlight System Preference pane.

I hope you find an answer.

[ElDiabloConCaca]

Are you using Aperture, perchance?

[Iritscen]

Nope, don't have Aperture. And what do you mean by repairing the sparse image, Satcomer? I did a little reading on sparseimages just now, but I'm not sure I even have one. A search turned up only a sparseimage that was used for a little application I once downloaded, but no sparseimage on the backup drive. I checked the RAID with Disk Utility and it says it's perfectly fine.

[Mikuro]

Well, first we need to find out where this 1.6GB is coming from.

Open Console (in /Application/Utilities) and look for any messages coming from "backupd" in the "All Messages" section. If something's going wrong, it might show up there.

If nothing jumps out at you in Console, there's a very handy command-line utility called tms which lets you look at your snapshots in more detail. Using tms you can see exactly which files have been changed or added after a given snapshot.

Once you expand tms, open Terminal (again in /Applications/Utilities), type "cd " (note the trailing space), and then drag the tms folder from the Finder into the Terminal window and hit return. Now type "./tms snapshots" and hit Return to get a list of the snapshots. Each snapshot is given a number, and you'll need to use these numbers for the rest of tms's commands. For example, your output might look something like this:

.../2008-07-25-145513: num=2649 state=4 type=2 ver=1
.../2008-07-25-135527: num=2648 state=4 type=2 ver=1
.../2008-07-25-125527: num=2647 state=4 type=2 ver=1
.../2008-07-25-115520: num=2646 state=4 type=2 ver=1
.../2008-07-25-110426: num=2645 state=4 type=3 ver=1
...

That shows info on my latest five snapshots (I edited it a bit for readability). If I wanted to see all the changes made in the last update, I would use tms's "delta" command with the number of the next-to-latest snapshot: "./tms delta 2648"

Or if I wanted to see the changed between the third and fourth in that list, I would type "./tms delta 2646 2647".

Using this technique, you can look for any mysterious files that shouldn't be copied. Obviously it will help if you already know one of the exact snapshots where this mysterious 1.6GB was copied.

I could only guess what's going wrong at this point. Maybe Time Machine has somehow got it into its head that it should back up your virtual memory swap files or Spotlight database.



FWIW, Time Machine has never used sparseimages for me. I'm not entirely sure, but I think it only uses sparseimages when backing up to a non-HFS+ volume and/or to a network disk.

[Iritscen]

Awesome, Mikuro! Thanks so much. I also love whoever wrote tms. The answer (and I hope this helps others too, because one would think this to be a widespread problem) to the question "What is the 1.6GB?" is, the TechTool Directory Protection Backups (or some similar kind of backup) that are stored in /.TechToolProItems/. In that root-level folder are two 561MB files (two states of the external drive) and two 273MB files for the internal drive. 561 + 561 + 273 + 273 = 1668MB! I have now excluded that folder from Time Machine's backups. I am really grateful over this one, because that was an insane waste of HD space that I could be using for multimedia work.

Now, this brings up a interesting (and largely rhetorical) question: How many people have TechTool Pro and have the Protection feature turned on and are using Time Machine? Do they all have this problem and are maybe not aware of it?

[Satcomer]

Originally Posted by Iritscen

Nope, don't have Aperture. And what do you mean by repairing the sparse image, Satcomer?

On my intel MacBook Pro I can open Disk Utility and in the left hand column I can select the sparse bundle on my Time Machine (Time Capsule) backup and repair it. That fixed a problem for me when the MacBook would just spin endlessly.

[HumanFish]

Hi

thought I would post this here as it is similar, not quite the same though.

I just bought a TC and am trying to get things started. I bought a 500GB UNIT.

TM has decided that it would back up 300GB of data even though my HD is 160GB I excluded folders.... but even after I have excluded everything it still requires more than 200GB and have done one backup now decides that the backup drive is full.

Has anyone else seen this.... is there a way to just start again ?

thanks

Mat