Hard Links  act a bit like aliases, but much more efficiently, and are the key to how Time Machine can back up only what’s changed, but have each backup be, in effect, a full backup of everything that was on your system at the time. 

When Time makes your first backup, it copies everything (except some system work files, trash, etc).  It also makes a dated backup folder, and places hard links in it to all the backup copies it just made.  Then when Time Machine makes a second backup, it copies everything that changed since the first backup, makes another dated backup folder, and puts hard links in it to the new backup items.  So far, so good.

But here’s the trick:  it also puts hard links in the second backup folder to the items that didn’t change.  So the folder now contains links to everything that was on your system at the time of the second backup.

This is greatly oversimplified, but should illustrate how it works: 

1. Create File A and File B, and run an initial backup (backup folder #1 below). 
   

2. Then delete File A, create file C, and run another (backup folder #2 below).
   

3. If you look at the backup folders via the Finder, you’ll see a bit of an illusion:

The File System Event Store  is a hidden log that OSX keeps on each HFS+ formatted disk/partition of changes made to the data on it.   It doesn’t list every file that’s changed, but each directory (folder) that’s had anything changed inside it.  That saves lots of space in the log, since often there are multiple changes to the same folder.  Each such change is called an event.

Any process can use it to find what’s been changed since the last event that process handled.  That’s how Spotlight, for example, knows when a file has been added or changed and needs to be re-indexed.

Normally, Time Machine can use it to find out what’s changed and needs to be backed-up, since it’s far faster than comparing everything on your system to the backups, as some other backup apps do.  (And it’s the reason that Time Machine can’t back up disks with other formats.)

But OSX can’t keep the log forever, of course, so if you haven’t done a backup in a long time, or there’s been a very large volume of changes (such as installing an OSX upgrade, which will add or change tens of thousands of files), the database won’t be complete.  Or, if your system shuts down abnormally, such as from a software problem, power loss, or forced power-off, it will also be suspect.  OSX will replace the Event Store and assign a new "UUID" to it (and send a message to that effect to your logs).

When that happens, the next backup will log a message about an "Event store UUID" not matching, meaning it's not the same one as on the previous backup.   Then Time Machine has to do a "deep scan" ("deep traversal" on Snow Leopard or Leopard), comparing everything on your system to the backups.  If you see a long "Preparing" phase ("Calculating changes" on Snow Leopard), that’s what’s going on.   From 10.6.3 through 10.6.8, you’ll see Scanning nnnn files messages on the TM Preferences Window and the TM Menu display from your menubar.

The time required for this depends on a number of things, but mainly the number of files on your system (more than the total size), and the type of connection to your backups.  So a relatively small system using a FireWire800 external drive will be far faster than a larger system being backed-up wirelessly to a Time Capsule.

1. A little "twist" to this is, if you add-up the sizes of the two Backup Folders, you’ll count File B twice!   This is because, unlike a "normal" file system, the backup copies don’t "belong" to one particular backup folder -- they're in both folders at the same time.   That's why you'll get odd figures from the Finder and/or 3rd-party utilities -- sometimes the Backups.backupdb folder is much less than the total of the backup folders;  other times it will be the sum of them, possibly much larger than the backup drive!

How Backups are Stored

Most of us back up a single internal disk (our Startup Disk) to a single disk or Time Capsule -- that seems pretty simple. 

But since Time Machine has the ability to back up multiple volumes (different disks and/or different partitions on the same disk), and/or multiple Macs, all to the same place, things get a bit more complicated.

Backups made to an internal or directly-connected external HD are stored in a single Backups.backupdb folder at the top level of the drive.  If you back up multiple Macs to the same volume (by connecting it to each Mac in turn), they're all in the same Backups.backupdb folder.

However, for backups made over a network (Ethernet or wireless), the Backups.backupdb folder is inside a container called a sparse bundle disk image.  See the pink box below for details. 

Either way, the structure of the Backups.backupdb folder is the same (Finder in List View):

One folder per Mac (blue); within that, one folder per backup (green); within each of those, one folder for each volume (drive or partition) (red).

However, there's more than meets the eye. While it shows the Mac's name and the names of the various partitions, that's not how they're really identified:

Each Mac is identified by a hardware address internal to the Mac.   It's embedded in the Logic Board (motherboard).  The hardware address isn't displayed in the backups, but is kept in an extended attribute of the folder representing the Computer.

That's why when you get a new logic board, Time Machine thinks you got a new Mac.  That's also why you can rename your Mac (System Preferences > Sharing) and Time Machine will automatically rename the Computer folder on the backups;  or you can have two Macs with the same name, but Time Machine still knows which backups belong to which Mac.  

On Snow Leopard or later, under some circumstances, if you get a new Mac and transfer your data from the old one, you should be asked if you want to "inherit" (or "reuse" on Snow Leopard) the old backups.  See Troubleshooting item #B5 for details.  If you select that option, the name and hardware ID are changed, so the backups appear to have been made from the new Mac.  If you aren't asked, or got a new Logic board, on Lion or later you may be able to do that manually, per Troubleshooting item #B6.

Each Backup is placed in a folder named for the date & time of the backup.  Both the start and completion timestamps are kept in extended attributes, among other info.

Each volume (drive/partition) that was backed-up is represented by a folder.  It contains the same structure of folders, sub-folders, and files as on the original volume.  Most of what you see, however, aren’t really files and folders at all;  they’re those hard links to the actual files and folders, as detailed in the tan box above.

For an OSX volume, such as Macintosh HD in the sample, user home folders are inside a Users folder (orange arrow).

The volume folder is also identified by its UUID (Universally Unique IDentifier).  That's not displayed, but is kept in an extended attribute on the folder for each volume.

That's assigned whenever you erase or reformat a partition, and is shown when you select the volume via Disk Utility (in your Applications/Utilities folder) and click the Info icon in the toolbar.  

Similar to the above, that's why you can rename a drive/partition, or have two with the same name, but Time Machine still knows which is which.  It's also why, when you replace or erase your startup drive or do a full restore to it (the installer erases it first), it's treated as a different one.

And it's why, if you replace a drive, and give it the same name as the old one, Time Machine still knows it's a different one. 

On Snow Leopard or later, if you select the "inherit" or "reuse" prompt, that will also identify the new Mac's startup drive with the backups of the old one, and change both the name of the folder and the UUID(s) of all the old backups, so they appear to have been made from the new one. 

Or, also on Snow Leopard or later, if you replace or erase your startup drive, under some circumstances Time Machine should automatically "associate" the new or erased drive with the backups of the old drive.  If it doesn't,  on Lion and later you may be able to do that manually, per Troubleshooting item #B6.

The ".inProgress" package

While a backup is running, the data is collected in a "package" (looks like a file, but is actually a special type of folder).  When the backup completes normally, it's converted into a normal backup folder (like the ones outlined in green), so you'll rarely see one. 

If the backup fails or is cancelled, though, it will remain.  On the next backup, Time Machine will "recover" the partial backup and convert it into a normal one.  This means it doesn't have to copy everything all over again;  just new changes and things that weren't copied before.

Since it's not a complete backup, you'll never see this via the Time Machine browser (the "Star Wars" display),  and you can't restore it with a full system restore, or use it with Setup Assistant or Migration Assistant, as the results would be incomplete at best. 

The Latest alias

This points to the latest successfully completed backup.  It's the one used by Setup Assistant or Migration Assistant to set up a new Mac from Time Machine backups.

Network backups in Sparse Bundles

When backups are made over a network (Ethernet or wireless), the Backups.backupdb folder is inside a container called a sparse bundle disk image.  A disk image is kind of like a disk-within-a-disk -- it has its own format, directories, etc.  Thus the format may be different from the format of the disk it's on.

Unlike backups made locally, there's a separate sparse bundle for each Mac, named for and identified to that Mac.  You can see the sparse bundle(s) via the Finder -- connect to the server, then click on the disk/partition name (Finder in Column View):

The Time Capsule's internal HD is named "Data" by default (you can change it via Airport Utility).  Any other drives connected to it will also be shown (such as "S. Misc3" in the sample). 

The names of the sparse bundles start with the name of the computer that was backed up, but vary a bit depending on how they were created, but most look like the first one in the sample. Sometimes there's a 12-digit address, and sometimes the .sparsebundle suffix isn't shown.

To see the backups in the disk image, double-click the sparse bundle via the Finder to mount the disk image inside it.  That will take a moment;  then the disk image (usually named Time Machine Backups, but sometimes Backups of <computer name>), will appear in the Finder sidebar and/or desktop (circled in green in the sample):

Double-click the disk image to open it.  Then you'll see the same structure as in the green box above.

The sparse bundle contains some identification and control files (different versions of OSX will have slightly different contents), plus a very large number of files in the bands folder -- your data (including the usual directory structure) is actually spread over them.

To see the contents of the sparse bundle, select and control-click (right-click) it and choose Show Package Contents (Finder in List View):

Do not attempt to change anything in those control files;  that can destroy your backups.  Among other things, they contain the hardware address of the Mac that was backed-up.  The sample is from Mountain Lion;  older versions of OSX don't have all the files shown above.  Leopard, for example, has only the last 3.

Unlike a normal folder or disk image, when a file in a sparse bundle is changed or deleted, the space in the band folder(s) remains as part of the sparse bundle -- the size of the sparse bundle doesn't change.  That space is re-used for new files, though, so the sparse bundle won't grow until all the vacated space is used, and new "band" files are added.   There is a UNIX command to "compact" the sparse bundle, which Time Machine uses when there isn't enough room for new backups.  You can also do that manually, if necessary.  See the pink box in Time Machine FAQ #12 for instructions.