Csdrhrt

Time machine uses incremental backups, so to restore a backup it needs all backups made. Time machine also has the feature to delete the oldest backup when there is no free space anymore.

But isn't this destroying the backup? There is a backup missing in the history. How does time machine handle this? What am I missing?

Short answer: it works fine thanks to weird filesystem magic.

Long answer: well, first, let's go over how a normal incremental backup system works (I think you already know this, but just to set the scene...) Suppose you do an initial backup and two incrementals based on it:

• In the initial backup, it copies all files from the source


• In the first incremental, it copies only files that changed since the initial backup


• In the second incremental, it copies only files that changed since the first incremental

In order to recover a bunch of files from the "latest backup", you'll need to splice together files from all three, depending on when each file was last modified.

If you delete the first backup, then all of the files that didn't change since that backup (& hence get backed up in one of the incrementals) are gone. This is the situation you assume in the question.

Time machine works a bit differently. Here's how the same sequence would work with Time Machine:

• In the initial backup, it copies all files from the source (into a timestamped snapshot directory on the backup target).


• 
  

  In the first incremental, it copies only files that changed since the initial backup (into a new snapshot directory) and adds hard links to files and directories that didn't change (except those that were deleted between the backups).

  
  
  

  Hard links are additional directory entries that point to the same file that the original entry did. Standard unix filesystems allow files to be hard-linked, but not directories; Apple figured out how to allow it for directories as well under the MacOS Extended filesystem. Anyway, the net result is that the second snapshot directory actually contains all files that existed when the second backup was made.

  
  



• In the second incremental, it again copies only files that changed since the first incremental, adds hard links to files and directories that didn't change (except those that were deleted). Again, this snapshot directory actually contains all files that existed when the third backup was made.

In order to recover a bunch of files from the "latest backup", no splicing is needed, since all of the files are already there in the latest snapshot directory. In fact, you can just open up the snapshot folder in the Finder, and see all the files that're part of that snapshot. But please don't make changes, or you may mess up not just that snapshot, but all the other ones it's interlinked with.

If you delete the first backup, then all of the files and directories in it get unlinked from that snapshot directory. But not necessarily deleted, that only happens when the last link is removed. Thus, all of the files (/versions of files) that were only in that snapshot get deleted, but those that were still around when the later backups were made still remain in existence, and are still in the other snapshot(s) they're valid for.

In fact, you (or the Time Machine backup system) can delete snapshots in any order without creating gaps in the later backups. TM uses this as part of its standard backup schedule: It creates a new snapshot once an hour, but after 24 hours it starts deleting most of those, leaving just one per day. After a month, it starts deleting most of the dailies, leaving just one per week. Because of the hard-linking, this doesn't cause any missing files in the snapshots that're retained.

(But again: don't make changes in the backup directories, or you may break things. TM has options to delete particular snapshots, or delete specific files from all snapshots they occur in, and these are safe. Other changes... not so safe.)