Mac – How to restore backups manually from Time Machine

The short answer is Yes.

If the Time Machine drive is accessible to Windows (via MacDrive or anything else), then it can be corrupted and directly destroyed. For this reason, I recommend turning off your Time Machine drive while in Windows.

Another possibility is that modifications to your primary drive could cause its ID to change, which would break its association with its existing Time Machine backups. The old Time Machine backups would still be there on the backup drive, but they would be treated as being backups of a different system. It sounds like this is probably what happened. It could be because you (or something) renamed the primary drive or otherwise tried to change it at the root level. But since you saw a MacDrive error, its more likely a glitch in MacDrive. There's not much you can do to prevent that except not use it.

Try running a Disk Utility check on all drives, preferably while booted from a DVD or an external drive. That will at least make sure nothing worse happened.

You will need an OS that can read the HFS+ filesystem. If you are running Windows, give MacDrive a try. You will have a trial period which will be plenty of time to allow you to at least pull the contents of the drive.

Once you access the Time Machine partition, look for the following directory: Backups.backupdb. In there, you will see a folder named after the machine you used to create the backups (e.g., cqm's Mac). Navigating into it will show a list of all the backups, each folder having a unique time stamp. Going into those folders will provide you with the general structure of your Mac (folders like Applications, Library, etc.). You'll want to go into Users and then your username. From there, just browse the contents and pull the files you are in need of.

Time Machine works by hard linking the files (saves space), but the general structure is identical to that of OS X. So finding things shouldn't be an issue.

Hard linking is a neat feature often overlooked. Unlike symlinks, which create a pointer at the OS level to the original file, hard linking actually creates a pointer at the file system level, so for all intents and purposes, they are treated as one file. Let me explain.

When a file is written to the disk, a pointer to that information is also made. When you, for example, delete something, typically the system just removes the pointer. But the data still remains on the disk. This is how recovery software works. It scans for the data and restores that pointer.

Hard linking, creates another pointer to the original data. If you remove one hard link, the other will function without problems (unlike symlinks, which are destroyed when the original file pointer is removed, resulting in a broken link). Finder won't differentiate between a real file and it's respective hard link, but you can see what files are hard linked using the ls command:

-rw-r--r--  2 cksum  staff  24806 Dec 27 12:02 icon.png
-rw-r--r--  2 cksum  staff  24806 Dec 27 12:02 icon2.png

As you can see from the above example, the "2" before the username (cksum) denotes that they are hard linked. If you created another hard link (e.g., icon3.png), that number would change to 3. Run an ls on any folder and you'll see that all the files will typically have a 1 before them. This means they are not hard linked.

As I said above, Time Machine uses hard links to cut down on the space it requires. And you can do the same. Rather than copying files or working with symlinks, it's possible to hard link content all over, and have your computer treat them as unique content. The beauty of this method is it will not inflate the data stored on your hard drive, since no new data is being written, just a new pointer.