How Leopard Time Machine works, and how it doesn’t

For Time Machine’s primary target audience, home users, backups of desktops and notebooks running OS X Leopard are fully automated, just as advertised. All that’s needed is an external hard drive that’s at least as large as the system’s internal drive. Pull up the Time Machine pane in System Preferences, select your external backup drive, and flip the big switch from OFF to ON.

After making an initial full copy of your system’s drive–file by file, not sector by sector–Time Machine scans your system hourly and copies the files changed since the last scan to the external drive. The copy is non-destructive: A file is not overwritten if the archive already has a copy of it. In effect, the old file is renamed before the new copy is written. A catalog tracks the location of every file in the archive, and the time at which file was appended to the archive.

Time machine conserves disk space by folding every 24 hours’ worth of hourly backups into one daily backup. It retains 30 days’ worth of daily backups. After 30 days, Time Machine starts folding daily backups into weekly backups, which are kept until the backup volume is full.

Apple brilliantly created a Finder-like view into the archive catalog that lets you browse your backup archive’s catalog hierarchically and temporally. As Apple puts it, you can see your entire disk as it was at a given point in time. True, but depending on how far back you step to find a lost file (for example), time may rewind in increments of hours, days or weeks.

As Apple presents the Time Machine filesystem view, you can see your system approximately:

As it was at the top of each hour today

As it was each day for the past 30 days, starting yesterday

As it was each week, starting 31 days ago, going back as far as disk space permits

A distraught user might only be interested in the amount of data he may have lost:

If you accidentally deleted a file today, you lose up to an hour’s work

If you deleted it between yesterday and 30 days ago, you lose up to a day’s work

If you deleted it more than 30 days ago, you can lose up to one week’s work, or all of it

There are users even among Apple’s targeted consumer population who need to think about their use of Time Machine, or who may be better off not using it at all. Consider the case of a home user who time-shifts television shows via iTunes, BitTorrent or another source. A sensible user deletes episodes he’s already watched to conserve disk space, but when Time Machine is active, it may take a month for that deleted episode to vanish from the backup drive. If the backup drive fills before it can archive 30 days’ worth of data, Time Machine flags an error and quits.

That scenario plays out for any user or application that creates expanding or volatile files. A 10 GB database can be appended to your Time Machine archive hourly. A lengthy log will be appended in its entirety even if only one line is added between hourly archive runs. Deft management of Time Machine’s exclusion list is essential for busy systems.

Time Machine is archiving, not data protection. If your external drive fails, you lose all of your backed up data. Data protection that covers the failure of a storage device calls for a disk array with RAID mirroring or parity striping. If you want to archive and protect your data, which isn’t a bad idea if you’re a professional Mac user, use a RAID volume as a Time Machine backup device.

Or, as I’ll detail in the next entry on the subject, use Xserve as a Time Machine back-end.

Lastly, to get ahead of what will likely be the most frequently asked questions about Time Machine:

Q: I set up a directory for Time Machine on my external drive. Why can’t I see it in Time Machine’s list of backup destinations?

A: Time Machine can only back up to volumes (formatted partitions) that are dedicated to the purpose. For geeks’ sake, if it doesn’t have a /dev/disk* entry, Time Machine can’t target it.

Q: Why won’t Time Machine use my AirPort Extreme base station’s USB drive, or other Mac or Windows storage on the network?

A: Windows and Apple file sharing share at the directory level. Even if you share a whole Windows lettered drive or the root directory of a Mac partition, you’re sharing a folder, not a volume.

Q: I’m a fearless genius. Isn’t there some way to work around these limitations short of hacking the kernel?

A: Learn ZFS, but know that the likelihood of creating unreadable Time Machine archives is enormous despite what appears to be success. I won’t help you beyond that.