Mac – Time Machine backup is too large (but shouldn’t be)

Much of what happens in Time Machine is undisclosed, but we know how the algorithm works so making an educated guess is possible:

Time Machine stores full versions of changed files on every backup. Not incremental differences. At the outset of a backup it does a search of your filesystem for files that have been modified since the last backup date. This cuts down what it has to look at. Then, for every file on this list, it compares it against the version that was last backed up. If it hasn't actually changed it just stores a pointer to the old version with some new metadata for the inode changes.

You've probably got timestamps changing on lots of files, but not the actual contents. So at the outset of a backup, Time Machine is adding up the size of the all files with changed timestamps and getting 15GB, but once it does the file diffs it turns out to be far less data that's actually changed. Time Machine, in the interests of being expedient about things, is likely making the cleanup space decision upfront and based on the worst-case estimate.

It can help to exclude some often-changing data from Time Machine backups. Things like the browser cache and IMAP mail offline archive (for example the local cache of your Gmail account). You can use the excellent and free TimeTracker tool from CharlesSoft to view the contents of your backups on a Time Machine volume. This might be able to give you an idea of what has changed from backup to backup so you can build a good exclusions list. For my recommendations on excluding things from Time Machine backups see this Ask Different answer.

Be careful with sudo and making sure you pick the correct Mac's files since there is no undo or confirmation of the following command:

sudo tmutil delete /Volumes/drive_name/Backups.backupdb/old_mac_name

The sudo command needs your password (and it won't echo to the screen, so just type it and pause to be sure you're dating the correct files before pressing enter). If you want to be safer, you can pick one snapshot to delete first to be sure the command works as intended. This is nice since it could take hours to clean up some larger backup sets and you want to leave the Mac confident it's deleting the correct information store.

You can use the tmutil tool to delete backups one by one.

sudo tmutil delete /Volumes/drive_name/Backups.backupdb/mac_name/YYYY-MM-DD-hhmmss

Since tmutil was introduced with Lion, this will not work on earlier OS versions.

If you want to get the current directory of backups (there can be multiple destinations defined and only one will be "current")

sudo tmutil machinedirectory