When investigating unexpected backup volume exhaustion, diagnosing corrupted configuration states, or auditing system modifications over time, Mac power users and system engineers frequently need to determine precisely which files changed between Time Machine backup points. While the Time Machine graphical interface lets you restore past versions of individual folders, it cannot calculate differential reports across thousands of system files. The native tmutil compare command provides granular comparison capabilities directly in the Terminal.
Command Syntax and Parameters
The compare verb in the tmutil utility evaluates two targets—such as a past backup snapshot and the current live filesystem, or two distinct historical backup points:
tmutil compare [options] [backup_path_1] [backup_path_2]| Parameter Switch | Comparison Behaviour | Ideal Scenario |
|---|---|---|
-s |
Summarises total size differences without printing individual file paths. | Quickly discovering how many gigabytes were added or deleted. |
-n |
Restricts comparison strictly to new, modified, or deleted files (ignoring metadata). | Focusing exclusively on content modifications. |
-m |
Includes metadata changes (POSIX permissions, extended attributes, flags). | Security auditing and troubleshooting access control list (ACL) shifts. |
-c |
Compares creation dates rather than modification dates. | Tracking newly imported media and newly generated datasets. |
Step-by-Step Differential Auditing
- Locate Backup Snapshot Identifiers: List available Time Machine backups and snapshots mounted on your system:
Note the full paths of the snapshots you wish to inspect (e.g.tmutil listbackups/Volumes/BackupDrive/Backups.backupdb/MacBook/2026-10-10-120000). - Compare the Most Recent Backup with Current Live Disk: Run
tmutil comparewithout arguments to compare the latest backup against your live system state:
Terminal outputs change records prefixed with status indicator symbols:tmutil compare+Indicates a newly created file not present in the backup.-Indicates a file deleted since the last backup.!Indicates a modified file where file size or timestamps shifted.
- Generate an Overall Change Summary: Instead of streaming thousands of modified cache files, request a high-level summary:
Example summary output:tmutil compare -sAdded: 4.12 GB Removed: 1.08 GB Changed: 850.4 MB - Compare Two Historical Snapshots Directly: To identify why a specific backup consumed an unusual amount of storage on an external drive, compare two specific past directories:
tmutil compare "/Volumes/Backup/2026-09-01-090000" "/Volumes/Backup/2026-10-01-090000"
Filtering Terminal Output for Fast Analysis
Combine tmutil compare with shell pipelines to isolate unusually large changes, such as virtual machine images or database files:
tmutil compare | grep -E "^!" | awk '$2 > 1000000000 {print $0}'This command flags any single modified file whose delta exceeds 1 GB, helping you quickly identify candidates for Time Machine exclusion lists.