10

The man page for tmutil mentions that Time Machine records checksums of files, and lists a verifychecksums command. The man page is sparse on details, and does not otherwise mention checksums. I was wondering whether Time Machine ever automatically verifies these checksums (or if these are only verified when you run verifychecksums manually)? The page also says checksums are not retroactively computed, so how can I list the files in my latest backup for which no checksum is available? Also, is it known what checksumming algorithm is used?

 verifychecksums path ...
         Compute a checksum of data contained within a backup and verify
         the result(s) against checksum information computed at the time
         of backup.

         No output is generated for matching checksums. Issues are
         reported using the following legend:

             !    The file's current checksum does not match the expected
                  recorded checksum.
             ?    The file's recorded checksum is invalid.

         Beginning in OS X 10.11, Time Machine records checksums of files
         copied into snapshots. Checksums are not retroactively computed
         for files that were copied by earlier releases of OS X.

The above is from the tmutil man page in OS X 10.11.6, maybe the one in macOS Sierra has more details.

Rinzwind
  • 3,731

1 Answers1

2

I have a partial answer to my own question: while I don’t know whether Time Machine ever automatically verifies the checksums, a post on ycombinator.com provided me with an answer to my other two questions. The checksumming algorithm is the same one as the default one used by the Terminal utility cksum. The checksum values are stored in the Time Machine backup as an extended attribute of each file (com.apple.finder.copy.source.checksum#N). So to list the files for which no checksum is available, you would search for all files in the latest backup without the attribute, using a Terminal command like this one:

find '/Volumes/Time Machine HD/Backups.backupdb/Mac/Latest' -type f -not -exec xattr -x -p 'com.apple.finder.copy.source.checksum#N' '{}' ';' -print 2>/dev/null | grep /

I’ll quote the original post for details on checking the stored checksum against the output of cksum:

RJIb8RBYxzAMX9u on Apr 18, 2017
[...] In any case, the "hash" appears to be CRC32, stored in extended attributes:

$ xattr .inputrc
com.apple.finder.copy.source.checksum#N
com.apple.metadata:_kTimeMachineNewestSnapshot
com.apple.metadata:_kTimeMachineOldestSnapshot
$ xattr -px 'com.apple.finder.copy.source.checksum#N' .inputrc
26 E5 4A AB
$ cksum .inputrc
2873812262 65 .inputrc
$ printf '%x\n' "$(cksum .inputrc | cut -d ' ' -f 1)"
ab4ae526
Rinzwind
  • 3,731
  • That's very useful information, but I had to add -print before 2>/dev/null to make your command work: find '/Volumes/Time Machine HD/Backups.backupdb/Mac/Latest' -type f -not -exec xattr -x -p 'com.apple.finder.copy.source.checksum#N' '{}' ';' -print 2>/dev/null | grep / – michau Aug 05 '19 at 20:10
  • Thanks! The command was indeed missing -print, I fixed it. – Rinzwind Aug 13 '19 at 12:41