Mac – How to use tmutil delete on Big Sur, APFS

Much of what happens in Time Machine is undisclosed, but we know how the algorithm works so making an educated guess is possible:

Time Machine stores full versions of changed files on every backup. Not incremental differences. At the outset of a backup it does a search of your filesystem for files that have been modified since the last backup date. This cuts down what it has to look at. Then, for every file on this list, it compares it against the version that was last backed up. If it hasn't actually changed it just stores a pointer to the old version with some new metadata for the inode changes.

You've probably got timestamps changing on lots of files, but not the actual contents. So at the outset of a backup, Time Machine is adding up the size of the all files with changed timestamps and getting 15GB, but once it does the file diffs it turns out to be far less data that's actually changed. Time Machine, in the interests of being expedient about things, is likely making the cleanup space decision upfront and based on the worst-case estimate.

It can help to exclude some often-changing data from Time Machine backups. Things like the browser cache and IMAP mail offline archive (for example the local cache of your Gmail account). You can use the excellent and free TimeTracker tool from CharlesSoft to view the contents of your backups on a Time Machine volume. This might be able to give you an idea of what has changed from backup to backup so you can build a good exclusions list. For my recommendations on excluding things from Time Machine backups see this Ask Different answer.

Yes, you can use the "TM Safety Net" helper bypass to bypass the ACL restrictions allow you to use rm the way you normally would. Except, of course, Time Machine uses "hard links" so rm does not entirely work the way you normally expect it to work.

The bypass program is not meant for people to use and can be hard to find, and it has moved around in various versions of OS X. I find it using this command:

locate TMSafetyNet.kext | grep bypass

Then you use it to authorize rm

sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass rm -rf /Volumes/Backups/Backups.backupdb/Mac/2015-04-09-072338/Macintosh\ HD/Users/bmike/Pictures/Photos\ Library.photoslibrary

Keep in mind, as mentioned, that because of the way Time Machine uses hard links of directories, this rm command can remove the file from other backups. I would not recommend using it unless you are trying to remove the file from all backups.

In fact, in general, I would not recommend using hidden commands like this. Use the GUI as Apple intended. Of course in this specific case, where you have a lot of computers to execute the same command on and you fully understand the impact of hard links, then go ahead.

If you are going to script this, your script should make sure that Time Machine is (a) disabled and (b) not currently running a backup (because unfortunately (a) does not guarantee (b)) before running commands using bypass. You probably should do that when running commands manually, too.