Skip to content

The Eclectic Light Company

Macs, painting, and more
Main navigation
  • Downloads
  • M1 & M2 Macs
  • Mac Problems
  • Mac articles
  • Art
  • Macs
  • Painting
hoakley March 27, 2020 Macs, Technology

What changes a file’s modification date, and what doesn’t?

Files in macOS have a lot of attributes, or metadata, which provide important information, such as the date that they were last modified. It’s not always clear which of these should be expected to change when different parts of a file change. This article explains a bit more about some of these which could readily confuse.

fileinfo01

When you change the data within a file, its date of last modification is also altered. This large PDF file hasn’t been modified since it was created almost seven years ago, but macOS also tracks when it was last opened, through an extended attribute (xattr) of type com.apple.lastuseddate, and the datestamp there is used for the Last opened field.

If you were to change some of that file’s attributes (metadata), such as its permissions, that also doesn’t alter the date of modification. As you do that without even opening the file, changing permissions alone won’t affect the Last opened date either.

Some apps, including my utility for checking the integrity of files, Dintch, don’t touch the data in a file, or its regular attributes like datestamps or permissions, but instead write to xattrs. In Dintch’s case, it calculates the SHA256 digest (checksum) of a file and writes that to a custom xattr.

Changing a file’s xattrs doesn’t alter the data in the file itself. Xattrs aren’t even stored in the main data area of a volume, but apart, in the file system metadata. So adding or changing a xattr won’t change the date of modification, nor the date that the file was last opened. In fact, unless you look at the xattrs using a utility such as my xattr editor xattred, you won’t even notice what’s happened.

Some users have noticed that changing permissions or xattrs does normally trigger a fresh copy of that file to be made when Time Machine next performs a back up. This is a particular concern when you change a lot of permissions, by resetting or repairing Home folder permissions, or tag a large folder using Dintch. But the same doesn’t happen when you use a third-party backup app instead of Time Machine. How can that be?

This all depends on the method that the backup system uses to determine which files need to be backed up. Most third-party tools, like ChronoSync, look at file modification dates to determine whether a file needs to be backed up. If that date is more recent than the last backup, that file will be backed up in the next backup. As changing permissions or xattrs doesn’t affect file modification dates, those actions won’t cause the file to be backed up again.

Time Machine is different. Instead of looking at file modification dates, it looks in a database stored on each volume which records all the events which occur in the file system, FSEvents. As actions on the file’s attributes and its xattrs are recorded in FSEvents, they will normally result in a fresh backup being made of the file, even though its data hasn’t been changed. The reasoning behind this is that, in a Time Machine backup, when a file isn’t backed up, a hard link is instead created to its previous copy. As that also connects to its old permissions, other attributes, and xattrs, it isn’t an accurate copy of the file as it has now become. There’s no way to make that hard link but add on the changed permissions or xattrs, for instance. That’s one drawback of conventional backup tools, compared with Time Machine.

It’s easy to demonstrate this on a folder which is being backed up hourly. Put a large document, such as my 7.9 MB PDF, in that folder, and let it get backed up the first time, as it stands. Once that has been done, change its permissions or xattrs, and watch it being backed up again an hour later.

I have one folder which is backed up every hour by both Time Machine and ChronoSync. It’s worth comparing what they did when I twiddled with that large PDF’s xattrs. Here are the log messages extracted from each of the Time Machine backups:
13:05 Copied 8 items (7.9 MB) from volume External1. Linked 494. Moved 0
14:05 Copied 5 items (7.9 MB) from volume External1. Linked 55. Moved 0
15:05 Copied 5 items (7.9 MB) from volume External1. Linked 55. Moved 0

ChronoSync made only one backup copy of that file over the same period:
13:05 Scanned: 220755 Processed: 3 Data copied: 7.91 MB Skipped: 0 Errors: 0
14:05 Scanned: 220755 Processed: 1 Data copied: 0 bytes Skipped: 0 Errors: 0
15:05 Scanned: 220755 Processed: 1 Data copied: 0 bytes Skipped: 0 Errors: 0

At 15:10, that PDF file was safely in both Time Machine’s backups and ChronoSync’s, and its data were identical, but only Time Machine showed the changes in xattrs which had taken place. The cost to the Time Machine backup was significant though: it had three complete copies of identical data. Scale that up to a whole Data volume and that could amount to tens or even hundreds of GB.

On Sunday I’ll explain how this advantage in Time Machine turns sour, and wastes your backup storage. In the meantime, feel free to work out for yourself how this could backfire.

Share this:

  • Twitter
  • Facebook
  • Reddit
  • Pinterest
  • Email
  • Print

Like this:

Like Loading...

Related

Posted in Macs, Technology and tagged backup, ChronoSync, extended attributes, file system, metadata, Time Machine, xattr. Bookmark the permalink.

Quick Links

  • Downloads
  • Mac Troubleshooting Summary
  • M1 & M2 Macs
  • Mac problem-solving
  • Painting topics
  • Painting
  • Long Reads

Search

Monthly archives

  • February 2023 (12)
  • January 2023 (74)
  • December 2022 (74)
  • November 2022 (72)
  • October 2022 (76)
  • September 2022 (72)
  • August 2022 (75)
  • July 2022 (76)
  • June 2022 (73)
  • May 2022 (76)
  • April 2022 (71)
  • March 2022 (77)
  • February 2022 (68)
  • January 2022 (77)
  • December 2021 (75)
  • November 2021 (72)
  • October 2021 (75)
  • September 2021 (76)
  • August 2021 (75)
  • July 2021 (75)
  • June 2021 (71)
  • May 2021 (80)
  • April 2021 (79)
  • March 2021 (77)
  • February 2021 (75)
  • January 2021 (75)
  • December 2020 (77)
  • November 2020 (84)
  • October 2020 (81)
  • September 2020 (79)
  • August 2020 (103)
  • July 2020 (81)
  • June 2020 (78)
  • May 2020 (78)
  • April 2020 (81)
  • March 2020 (86)
  • February 2020 (77)
  • January 2020 (86)
  • December 2019 (82)
  • November 2019 (74)
  • October 2019 (89)
  • September 2019 (80)
  • August 2019 (91)
  • July 2019 (95)
  • June 2019 (88)
  • May 2019 (91)
  • April 2019 (79)
  • March 2019 (78)
  • February 2019 (71)
  • January 2019 (69)
  • December 2018 (79)
  • November 2018 (71)
  • October 2018 (78)
  • September 2018 (76)
  • August 2018 (78)
  • July 2018 (76)
  • June 2018 (77)
  • May 2018 (71)
  • April 2018 (67)
  • March 2018 (73)
  • February 2018 (67)
  • January 2018 (83)
  • December 2017 (94)
  • November 2017 (73)
  • October 2017 (86)
  • September 2017 (92)
  • August 2017 (69)
  • July 2017 (81)
  • June 2017 (76)
  • May 2017 (90)
  • April 2017 (76)
  • March 2017 (79)
  • February 2017 (65)
  • January 2017 (76)
  • December 2016 (75)
  • November 2016 (68)
  • October 2016 (76)
  • September 2016 (78)
  • August 2016 (70)
  • July 2016 (74)
  • June 2016 (66)
  • May 2016 (71)
  • April 2016 (67)
  • March 2016 (71)
  • February 2016 (68)
  • January 2016 (90)
  • December 2015 (96)
  • November 2015 (103)
  • October 2015 (119)
  • September 2015 (115)
  • August 2015 (117)
  • July 2015 (117)
  • June 2015 (105)
  • May 2015 (111)
  • April 2015 (119)
  • March 2015 (69)
  • February 2015 (54)
  • January 2015 (39)

Tags

APFS Apple AppleScript Apple silicon backup Big Sur Blake bug Catalina Consolation Console diagnosis Disk Utility Doré El Capitan extended attributes Finder firmware Gatekeeper Gérôme HFS+ High Sierra history of painting iCloud Impressionism iOS landscape LockRattler log logs M1 Mac Mac history macOS macOS 10.12 macOS 10.13 macOS 10.14 macOS 10.15 macOS 11 macOS 12 macOS 13 malware Mojave Monet Monterey Moreau MRT myth narrative OS X Ovid painting Pissarro Poussin privacy realism Renoir riddle Rubens Sargent scripting security Sierra SilentKnight SSD Swift symbolism Time Machine Turner update upgrade Ventura xattr Xcode XProtect

Statistics

  • 13,796,636 hits
Blog at WordPress.com.
Footer navigation
  • About & Contact
  • Macs
  • Painting
  • Language
  • Tech
  • Life
  • General
  • Downloads
  • Mac problem-solving
  • Extended attributes (xattrs)
  • Painting topics
  • Hieronymus Bosch
  • English language
  • LockRattler: 10.12 Sierra
  • LockRattler: 10.13 High Sierra
  • LockRattler: 10.11 El Capitan
  • Updates: El Capitan
  • Updates: Sierra, High Sierra, Mojave, Catalina, Big Sur
  • LockRattler: 10.14 Mojave
  • SilentKnight, silnite, LockRattler, SystHist & Scrub
  • DelightEd & Podofyllin
  • xattred, Metamer, Sandstrip & xattr tools
  • 32-bitCheck & ArchiChect
  • T2M2, Ulbow, Consolation and log utilities
  • Cirrus & Bailiff
  • Taccy, Signet, Precize, Alifix, UTIutility, Sparsity, alisma
  • Revisionist & DeepTools
  • Text Utilities: Nalaprop, Dystextia and others
  • PDF
  • Keychains & Permissions
  • LockRattler: 10.15 Catalina
  • Updates
  • Spundle, Cormorant, Stibium, Dintch, Fintch and cintch
  • Long Reads
  • Mac Troubleshooting Summary
  • LockRattler: 11.0 Big Sur
  • M1 & M2 Macs
  • Mints: a multifunction utility
  • LockRattler: 12.x Monterey
  • VisualLookUpTest
  • Virtualisation on Apple silicon
  • LockRattler: 13.x Ventura
Secondary navigation
  • Search

Post navigation

Gustave Moreau and Symbolism: Oedipus and the Sphinx
Gustave Moreau and Symbolism: Salome

Begin typing your search above and press return to search. Press Esc to cancel.

  • Follow Following
    • The Eclectic Light Company
    • Join 3,133 other followers
    • Already have a WordPress.com account? Log in now.
    • The Eclectic Light Company
    • Customize
    • Follow Following
    • Sign up
    • Log in
    • Copy shortlink
    • Report this content
    • View post in Reader
    • Manage subscriptions
    • Collapse this bar
 

Loading Comments...
 

    %d bloggers like this: