KISS

Be Among the 20% of the Best!

Restoring Files From TimeMachine Backup Manually

| comments

TimeMachine is a backup system working out-of-box on OS X, supports encryption and is quite easy to setup. Backing up is only a half of the deal though; you may need to restore it some day. You can restore the whole system on a new Mac, and it’s also possible to get the individual files if the need arises.

You can mount your external disk or TimeCapsule backup as another volume. In case of TimeCapsule, you connect to your WiFi router, go to Data/, and mount an image with the name like my_mbp.sparsebundle (for encrypted backups, OS X creates an encrypted sparse bundle which can be stored on any filesystem), where my_mbp is your computer’s name.

Then on your mounted volume, you’ll see the Backups.backupdb/ directory, inside a directory with the name of your computer (say, my_mbp/), then timestamp-named directories with different backups. So restoring some files should be as easy as:

1
2
3
$ rsync -av \
    "/Volumes/backups/Backups.backupdb/my_mbp/2015-06-14-180000/Macintosh HD/Users/user/src/project/projectTests/External/OCMock.framework" \
    ~/Desktop/OCMock.framework

And it works!

I also tried restoring with “Finder” or “Path Finder”, and my files got some weird permissions, so I couldn’t do anything with those files:

1
2
$ mkdir ~/Desktop/OCMock.framework/1
mkdir: /Users/user/Desktop/OCMock.framework/1: Permission denied

There are two steps to fix this:

Removing ACL

There is an ACL (Access Control List) on those files:

1
2
3
4
5
6
7
8
9
10
11
12
$ ls -le ~/Desktop/OCMock.framework
total 48
lrwxr-xr-x+ 1 user  staff     24 Jun 10 15:57 Headers -> Versions/Current/Headers
 0: group:everyone deny write,delete,append,writeattr,writeextattr,chown
-rw-r--r--@ 1 user  staff  10174 Jun 10 15:57 License.txt
 0: group:everyone deny write,delete,append,writeattr,writeextattr,chown
lrwxr-xr-x+ 1 user  staff     23 Jun 10 15:57 OCMock -> Versions/Current/OCMock
 0: group:everyone deny write,delete,append,writeattr,writeextattr,chown
lrwxr-xr-x+ 1 user  staff     26 Jun 10 15:57 Resources -> Versions/Current/Resources
 0: group:everyone deny write,delete,append,writeattr,writeextattr,chown
drwxr-xr-x@ 4 user  staff    136 Jun 10 15:57 Versions
 0: group:everyone deny add_file,delete,add_subdirectory,delete_child,writeattr,writeextattr,chown

Removing it:

1
$ chmod -RN ~/Desktop/OCMock.framework

This removed ACL from files and directories, but not symlinks. After a couple of tries, this blogpost helped:

1
$ echo | chmod -h -E ~/Desktop/OCMock.framework/**/*(@)

**/*(@) is a special globbing syntax in zsh to recursively find all symlinks in the directory.

Removing extended attributes

There are also useless extended attributes on those files:

1
2
3
4
5
6
7
8
9
10
11
12
13
$ xattr -l ~/Desktop/OCMock.framework/
com.apple.metadata:_kTimeMachineNewestSnapshot:
00000000  62 70 6C 69 73 74 30 30 33 42 2D 63 C3 7F 00 00  |bplist003B-c....|
00000010  00 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00  |................|
00000020  00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 11                                            |..|
00000032
com.apple.metadata:_kTimeMachineOldestSnapshot:
00000000  62 70 6C 69 73 74 30 30 33 41 BB 1F 76 69 00 00  |bplist003A..vi..|
00000010  00 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00  |................|
00000020  00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 11                                            |..|
00000032

Remove those:

1
$ xattr -r -c ~/Desktop/OCMock.framework/

Now we have the clean files:

1
2
3
4
5
6
7
$ ls -le ~/Desktop/OCMock.framework
total 48
lrwxr-xr-x  1 user  staff     24 Jun 14 21:47 Headers -> Versions/Current/Headers
-rw-r--r--  1 user  staff  10174 Jun 14 21:47 License.txt
lrwxr-xr-x  1 user  staff     23 Jun 14 21:47 OCMock -> Versions/Current/OCMock
lrwxr-xr-x  1 user  staff     26 Jun 14 21:47 Resources -> Versions/Current/Resources
drwxr-xr-x  4 user  staff    136 Jun 14 21:47 Versions

Use rsync if possible.

Comments