Instead of using the modification date, it tries to use the FSEvents database, which logs all changes which are made to files on each volume, including changes to file metadata. Time Machine has a cunning system which works around this problem. If a file’s metadata change, then the hard link will not reflect that change, but will show a previous version of the metadata, which isn’t an accurate reflection of the file’s state at the time of the backup. This is because it can do one of two things for a file which is included in the volume or folder it has to back up: it can either save a complete copy of that file, including its attributes and extended attributes (metadata), or it can create a hard link to the previous version of that file. One unfortunate consequence of this is that changes to a file which don’t alter its modification date, such as changes to its extended attributes, don’t normally result in a new copy of that file being made in the backup. Third-party backup apps generally rely on the file modification date to determine whether a file needs to be backed up: if that date is more recent than the last backup, then the file is included in the next backup. It doesn’t change important file attributes, like the date of last modification, and extended attributes are even ignored when reporting a file’s size. The extended attribute involved is named, and like all those quarantine flags, has never been mentioned let alone documented by Apple.Īs I explained previously, fiddling with a file’s extended attributes has complicated consequences.
This time it appears to be part of the per-document privacy controls which were introduced in 10.15. In Catalina, there’s another even more puzzling reason for an extended attribute being written to a document. Even when that PDF was created on that same Mac and has never left its storage, Preview follows this same behaviour. Apple has never explained this behaviour, but as the quarantine flag is used to mark potentially malicious files, we must presume that this is for security. That happens regardless of whether you save that document or not. Every time that Preview opens a PDF document, it marks that document by writing a quarantine flag to it, if that hasn’t already been done.
One of the commonest uses of Apple’s bundled Preview app is to read PDF documents, which is a default set in macOS. The chain starts with security and privacy protection, which in recent versions of macOS have taken to using extended attributes a great deal. Although this is quite a complex and technical game, I promise you a reward at the end: plenty of your backups could be wasted space. Let’s play unintended consequences, in this case with macOS security and privacy protection, the file system and Time Machine backups.
0 kommentar(er)
