Timeshift

Submitted by peter on Tue, 06/12/2018 - 17:11

Timeshift is promoted as a way to recover files for a broken system or user directory. From everything I read, Timeshift expects you to install Linux first then recover configuration and user data files. I use Timeshift to backup everything so I can restore anything.

Timeshift does not backup all the system level files. As an example, the /dev directory is not backed up. Some files should be excluded because they are built at boot time and discarded after use. Unfortunately Timeshift does not tell you what is excluded.

You have to add some of your own exclusions to remove the temporary junk from your user directory.

Similar programs

Timeshift uses rsync in the background and there are a dozen other programs using rsync in the background. Outside of the rsync usage, Timeshift can be compared to the System Restore program in Windows, BackInTime (https://github.com/bit-team/backintime), the unmaintained TimeVault, and Time Machine (Mac OS only).

Timeshift is easier to use than System Restore. Both require understanding to make a restore work. Timeshift can backup system files and user data while System Restore requires a separate backup for user data. Both require a working system for any type of restore. For Linux, you keep a bootable USB stick ready to restore Linux then boot the Linux to run the Timeshift restore.

Processing time

Timeshift backup file structure

Timeshift creates the following file structure in the backup.

timeshift
  snapshots
    2018-01-23_20-10-40
      localhost
        /bin
        : etc :
      exclude.list
      info.json
      rsync-log.gz
      rsync-log-changes
    2018-02-13_15-42-22
  snapshots-boot
  snapshots-daily
  snapshots-hourly
  snapshots-monthly
  snapshots-ondemand
    2018-01-23_20-10-40 (These are links )
    2018-02-13_15-42-22 ( to the backup in snapshots.)
  snapshots-weekly

exclude.list

Exclude.list contains many lines similar to the following.

/dev/*
/proc/*
/sys/*
/media/*
/mnt/*
/tmp/*
/run/*
/var/run/*
/var/lock/*
/root/.mozilla/firefox/*.default/Cache

info.json

info.json is similar to the following.

{
  "created" : "1516698640",
  "sys-uuid" : "49af5bf1-77b5-4282-add0-ee9a34a20201",
  "sys-distro" : "LinuxMint 18.3 (sylvia)",
  "app-version" : "17.11",
  "file_count" : "706395",
  "tags" : "ondemand",
  "comments" : "",
  "live" : "false",
  "type" : "rsync"
}

rsync-log.gz

rsync-log.gz contains rsync-log compressed. rsync-log contains something like the following.

2018/01/23 20:10:40 [7793] building file list
2018/01/23 20:10:40 [7793] .d..t...... ./
2018/01/23 20:10:40 [7793] >f+++++++++ core
2018/01/23 20:10:40 [7793] cL+++++++++ initrd.img -> boot/initrd.img-4.13.0-26-generic
2018/01/23 20:10:40 [7793] cL+++++++++ initrd.img.old -> boot/initrd.img-4.10.0-42-generic
2018/01/23 20:10:40 [7793] >f+++++++++ tmp\Activation.log
2018/01/23 20:10:40 [7793] cL+++++++++ vmlinuz -> boot/vmlinuz-4.13.0-26-generic
2018/01/23 20:10:40 [7793] cL+++++++++ vmlinuz.old -> boot/vmlinuz-4.10.0-42-generic
2018/01/23 20:10:40 [7793] cd+++++++++ bin/
2018/01/23 20:10:40 [7793] >f+++++++++ bin/archdetect
2018/01/23 20:10:40 [7793] >f+++++++++ bin/bash

rsync-log-changes

In the first backup of a series, rsync-log-changes contains something like the following. The only difference from rsync-log is the missing first line. The similarity happens because this is the first backup and every file is a change

2018/01/23 20:10:40 [7793] .d..t...... ./
2018/01/23 20:10:40 [7793] >f+++++++++ core
2018/01/23 20:10:40 [7793] cL+++++++++ initrd.img -> boot/initrd.img-4.13.0-26-generic
2018/01/23 20:10:40 [7793] cL+++++++++ initrd.img.old -> boot/initrd.img-4.10.0-42-generic
2018/01/23 20:10:40 [7793] >f+++++++++ tmp\Activation.log
2018/01/23 20:10:40 [7793] cL+++++++++ vmlinuz -> boot/vmlinuz-4.13.0-26-generic
2018/01/23 20:10:40 [7793] cL+++++++++ vmlinuz.old -> boot/vmlinuz-4.10.0-42-generic
2018/01/23 20:10:40 [7793] cd+++++++++ bin/
2018/01/23 20:10:40 [7793] >f+++++++++ bin/archdetect
2018/01/23 20:10:40 [7793] >f+++++++++ bin/bash

In the second and subsequent snapshots in a series, the rsync-log-changes file is smaller because it has only the changes. The file from the second backup looks like the following example. Notice that bin/archdetect and other files are not listed which means they are not changed.

2018/02/13 15:42:22 [3806] .d..t...... ./
2018/02/13 15:42:23 [3806] >f.st...... core
2018/02/13 15:42:23 [3806] cLc.t...... initrd.img -> boot/initrd.img-4.13.0-32-generic
2018/02/13 15:42:23 [3806] cLc.t...... initrd.img.old -> boot/initrd.img-4.13.0-31-generic
2018/02/13 15:42:23 [3806] cLc.t...... vmlinuz -> boot/vmlinuz-4.13.0-32-generic
2018/02/13 15:42:23 [3806] cLc.t...... vmlinuz.old -> boot/vmlinuz-4.13.0-31-generic
2018/02/13 15:42:23 [3806] cd..t...... bin/
2018/02/13 15:42:23 [3806] >f..t...... bin/journalctl

What does Timeshift copy and not copy?

Directories copied

The following directories were copied with what looks like no changes.

Directory Contains Notes
bin 176 No subdirectories.
boot 24 Contains grub and kernels. Clean this up if there are many kernels.
home 1 Just my user directory.
lib 30 Bunch of OS files.
lib64 1 Link to other file.
opt 5 A few config files for applications.
sbin 293 Command line applications including fdisk.
usr 8 Mixed pile including Linux headers.
var 12 Another mixture of useful and junk data.

Directories empty

Directory Contains Reason
cdrom 0 No CD drive
mnt 0 Nothing mounted
root ? Root is an unreadable link to nowhere.
srv 0 Unused.

Directories not copied

Directory Contains Copied Reason
/dev 210 0  
etc 275 274  
media 1 0 The only thing in media is the backup disk
proc 246 0  
run 47 0  
sys 11 0  
tmp 14 0  

Files copied

core
initrd.img
tmp\Activation.log
vmlinuz
vmlinuz.old

Notes on odd directories

/dev

/dev contains essential device files. They are not backed up by Timeshift. If there is a problem with a missing file, you have to build the file through a reinstall. Timeshift appears to expect you to install Linux first when you restore to different hardware.

/srv is a directory set up by someone to serve data through things like Web servers. Many services use a subdirectory in /var. When you are developing Web sites, you can use a subdirectory in your home directory so that all the server data is backed up with all your other project data. /srv has no use on any of my machines.

The settings file

Timeshift has a configuration file named /etc/timeshift.json and another named /etc/default/timeshift.json. Timeshift appears to copy the default file as /etc/timeshift.json then update the new file. /etc/timeshift.json contains your settings and the id of the most recent backup disk.

/var/lib/dpkg/info contains timeshift.conffiles, timeshift.list, and timeshift.md5sums. timeshift.conffiles points to /etc/default/timeshift.json. timeshift.list has a long list of directories and files used in the installation. timeshift.md5sums contains the MD5 checksums for all the Timeshift files installed in the system.

/var/log/timeshift contains logs from backups. /tmp/timeshift contains some unknown files. /usr/bin/ contains some Timeshift binary files.

/usr/share contains Timeshift icons, appdata, an applications file, locale files, a doc file, images, and other things but nothing about the current configuration.