How Leopard Time Machine works, and how it doesn't

For Time Machine's primary target audience, home users, backups of desktops and notebooks running OS X Leopard are fully automated, just as advertised. All that's needed is an external hard drive that's at least as large as the system's internal drive. Pull up the Time Machine pane in System Preferences, select your external backup drive, and flip the big switch from OFF to ON.

After making an initial full copy of your system's drive--file by file, not sector by sector--Time Machine scans your system hourly and copies the files changed since the last scan to the external drive. The copy is non-destructive: A file is not overwritten if the archive already has a copy of it. In effect, the old file is renamed before the new copy is written. A catalog tracks the location of every file in the archive, and the time at which file was appended to the archive.

Time machine conserves disk space by folding every 24 hours' worth of hourly backups into one daily backup. It retains 30 days' worth of daily backups. After 30 days, Time Machine starts folding daily backups into weekly backups, which are kept until the backup volume is full.

Apple brilliantly created a Finder-like view into the archive catalog that lets you browse your backup archive's catalog hierarchically and temporally. As Apple puts it, you can see your entire disk as it was at a given point in time. True, but depending on how far back you step to find a lost file (for example), time may rewind in increments of hours, days or weeks.

As Apple presents the Time Machine filesystem view, you can see your system approximately:

As it was at the top of each hour today

As it was each day for the past 30 days, starting yesterday

As it was each week, starting 31 days ago, going back as far as disk space permits

A distraught user might only be interested in the amount of data he may have lost:

If you accidentally deleted a file today, you lose up to an hour's work

If you deleted it between yesterday and 30 days ago, you lose up to a day's work

If you deleted it more than 30 days ago, you can lose up to one week's work, or all of it

There are users even among Apple's targeted consumer population who need to think about their use of Time Machine, or who may be better off not using it at all. Consider the case of a home user who time-shifts television shows via iTunes, BitTorrent or another source. A sensible user deletes episodes he's already watched to conserve disk space, but when Time Machine is active, it may take a month for that deleted episode to vanish from the backup drive. If the backup drive fills before it can archive 30 days' worth of data, Time Machine flags an error and quits.

That scenario plays out for any user or application that creates expanding or volatile files. A 10 GB database can be appended to your Time Machine archive hourly. A lengthy log will be appended in its entirety even if only one line is added between hourly archive runs. Deft management of Time Machine's exclusion list is essential for busy systems.