Given that Time Machine backups are constructed from very large numbers of real files and folders, and hard linked files and folders, they are complex structures to work with. So what can you do with them in safety, and how?

Before looking at that, I’d like to make my terminology clear, to avoid any confusion:

• By Time Machine backup, I refer to the hourly backups made by Time Machine, and exclude local snapshots made by Mobile Time Machine. Snapshots are quite different, particularly in High Sierra when running on an APFS volume. All you can really do with such a snapshot is delete it: it doesn’t consist of files and folders in the way that a regular backup does.
• A backup set is the complete set of all backups made of a particular Mac, and equates to the folder named according to the Mac which it backs up, e.g. Howard’s iMac.
• A backup specifically refers to one datestamped folder within a backup set, consisting of the backup of one or more volumes at one specific moment.

The first thing that you notice if you ever try trashing a Time Machine backup folder is how long it takes to empty. If you’re going to remove complete backup sets, it is much quicker to format the whole volume, if you can.

More selective surgery needs to be thought out carefully. Time Machine backups look like perfectly ordinary files and folders, but remember that they contain your previous backups. Don’t just blunder in, moving items here, and deleting them there, as you are likely to make them unusable. A broken backup is little more useful than no backup at all.

Within any backup set, you can move, copy, or delete items down to the level of individual backups using the Finder. So if you decide you want to save space by removing one or more complete backups, that should be safe to perform in the Finder. You can also remove complete backups in the Time Machine app, or using tmutil at the command line: in theory, they should be safer tools to use, although you may feel that they are more cumbersome.

You should not make any changes within the Backups.backupdb folder using commands in Terminal, though.

If you want to make changes within backups, such as removing a sensitive file or folder from them, the only safe way to do that is in the Time Machine app, not in the Finder or Terminal.

If you followed yesterday’s discussion here about hard links and their role in Time Machine backups, you should now be puzzled. If Time Machine backups are just very large and elaborate assemblies of hard links and real files/folders, then you should be safe to remove individual files (whether hard links or not) from backups either in the Finder or at the command line. But Apple, and bitter experience, say not to.

There’s more to a Time Machine backup than just the files and folders of the backup, though. At the top level of a backup volume, there are several important folders, mostly hidden:

• .fseventsd, the record of File System Events, which is common to all volumes
• .Spotlight-V100, a folder full of vital Spotlight metadata, which is required to support search of backups
• .Trashes, the normal volume Trash folder
• tmbootpicker.efi, which allows the volume to be used as a boot disk when you boot into Startup Manager using the Option key held during startup. The backup is then identified as EFI Boot.
• Backups.backupdb containing the backups.

In Backups.backupdb, you’ll find:

• .RecoverySets, a hierarchy of folders containing com.apple.recovery.boot, which is in essence a Recovery volume, complete with Apple Diagnostics. These are needed when you boot from the backup volume.
• .spotlight_repair and .spotlight_temp, with more Spotlight search files.
• [yourname]’s [macmodel], containing backup sets.

Within each backup set, you’ll find:

• .Backup.log, a small log file for the backup.
• .com.apple.TMCheckpoint, a tiny marker file.
• .exclusions.plist, a property list detailing all the folders and files excluded from that backup.
• [volname] folder containing the backup for that volume.

Within a volume file in a backup set, you’ll find:

• .com.apple.backupd.mvlist.plist, normally an empty property list;
• .file and .vol from volfs;
• .DocumentRevisions-V100 containing a backup of the macOS versioning database;
• the folders and files in the backup of that volume.

The odd thing is that none of those hidden files or folders seems to contain much additional data about a backup set which might make it dangerous to mess with the internals of that set. They are not like Photos libraries, for example, which contain databases and a lot of other data which makes the library work.

So for the moment, the reason for not messing around inside an individual Time Machine backup seems elusive. If you have more insight into what might become damaged, I’d love to hear about it, please.

For High Sierra, Apple gives details in this Help article, which is exactly the same as that for macOS Sierra.