Time Machine是macOS中的标准备份软件应用程序。Time Machine进行过去24小时的每小时备份，过去一个月的每日备份以及超过一个月的所有内容的每周备份。它会进行备份，直到卷空间不足为止。通常，这些备份存储在具有HFS +文件系统的磁盘上。
Time Machine is the standard backup software application in macOS. Time Machine makes hourly backups of the last 24 hours, daily backups for the past month, and weekly backups for everything older than a month. It makes backups until the volume runs out of space. Often these backups are stored on a disk with HFS+ file system.
在本文中，我们将讨论Time Machine中数据存储的详细信息以及如何在数据恢复过程中使用它。
In this article, we will discuss the details of data storage in the Time Machine and how to use it in the data recovery process.
HFS+中的硬链接 Hard links in HFS+
Time Machine使用硬链接存储数据。硬链接是将同一文件放置在不同文件夹（目录）中的一种方法。
Time Machine uses Hard links to store data. Hard links are a way to place the same file in different folders (catalogs).
让我们举个例子。有两个文件：
Let’s take an example. There are two files:
\folder1\file1.txt \folder2\file2.txt
一个文件是另一个的硬链接。这意味着：
And one file is the hard link of another. It means that:
- 操作系统和大多数软件都将这两个文件识别为单独的文件；
both files are recognized as separate files by the operating system and most software; - 如果我们更改一个文件的内容，则另一个文件的内容会自动更改；
if we change the content of one file, the content of another file is changed automatically; - 如果我们删除一个文件，则另一个文件保持不变
if we delete one file, another file remains intact
可以为一个文件创建多个硬链接，也可以为目录创建硬链接。
It’s possible to create several hard links for one file, it’s also possible to create a hard link for catalogs.
对于HFS +文件系统，有一个原始文件，并且该原始文件有一个或几个硬链接。原始文件存储在HFS +私有数据中，并且具有类似iNode1234567的名称。例如，我们有文件“ file1.txt ”，并为此文件创建一个硬链接“ file2.txt ”。现在，我们在HFS +私有数据目录中有一个原始文件，并且有两个硬链接（file1.txt ‘和’ file2.txt）。
For HFS+ file system, there are one original file, and one or several hard links for this original file. Original files are stored in HFS+ Private Data and have names like iNode1234567. For example, we have file ‘file1.txt‘ and create a hard link ‘file2.txt‘ for this file. Now we have one original file in the HFS+ Private Data catalog and two hard links (file1.txt‘ and ‘file2.txt).
目录的硬链接原件存储在..HFS+ Private Directory Data_文件夹中
Hard link originals for catalogs are stored in .HFS+ Private Directory Data_ folder.
HFS +文件系统中Time Machine的数据结构 The data structure of the Time Machine in the HFS+ file system
详细信息取决于最终用户的设置，但通常，Time Machine将数据保存在Backups.backupdb文件夹或该文件夹中的名称包含单词“ Time Machine”的HFS +分区上。此文件夹或具有用户名的文件夹都具有一组目录，这些目录的格式类似YYYY-MM-DD-hhmmss（年，月，日，时，分，秒）
Details depend on the end-user settings, but in general, Time Machine saves data on HFS+ partition in Backups.backupdb folder or the folder, which name contains words “Time Machine”. Either this folder or a folder with username has a set of catalogs with masl likeYYYY-MM-DD-hhmmss (year, month, day, hour, minute, second).
如果打开其中一个目录，则可以看到目录名称中提到的确切日期和时间的文件系统快照。显然，大多数文件更改的频率低于创建副本的频率，因此Time Machine不会复制未更改的文件，而是为这些文件创建硬链接。它充分减少了快照创建时间和已用空间。但是，此结构使Time Machine的数据恢复过程复杂化。
If we open one of these catalogs we can see a snapshot of the file system at exact date and time mentioned in catalog name. Obviously the most of the files are changed less commonly than the copies are created, so Time Machine doesn’t copy unchanged files, it creates hard links for these files. It sufficiently decreases snapshot creation time and used space. However, this structure complicates the data recovery process from Time Machine.
此外，Time Machine不是唯一使用硬链接的地方，而是这些硬链接最常使用的地方
Besides, the Time Machine is not the only place where the hard links are used, but that’s where these links are most frequently used.
数据提取器中具有硬链接的操作方法 Modus operandi with hard links in Data Extractor
在Data Extractor中使用硬链接的主要功能是过渡到原始文件：
The main feature with hard link working in Data Extractor is the transitioning to the original file:
- 如果我们尝试为硬链接构建映射，则会构建原始文件的映射。
if we try to build a map for a hard link, a map of the original file is built; - 如果我们保存硬链接，则原始文件的数据将以硬链接的名称保存。
if we save the hard link, the data of the original file is saved under the name of the hard link.
这对于从存在物理问题的磁盘中恢复数据非常有用。我们构建所需数据的地图，读取此地图，然后保存数据
This is very useful for recovering data from disks with physical issues. We build a map of needed data, we read this map, we save the data.
但是，保存数据的大小存在问题。由于硬链接，它大大增加了。
However, there is a problem with the size of the saved data. It increases enormously due to hard links.
- 每个原始文件可以具有数十个硬链接。对于每个硬链接，都会构建原始文件的地图并将其添加到总地图中。因此，总图的大小可能比整个驱动器的大小大。
each original file can have a few tens of hard links. For each hard link, the map of the original file is built and added to the total map. So the size of the total map can be way more than the size of the whole drive. - 每个硬链接都保存为单独的文件。因此，已保存文件的大小可能大大超过整个驱动器的大小。
each hard link is saved as a separate file. So the size of saved files can be massively more than the size of the whole drive.
具有硬链接的数据恢复过程的解决方案 The solution for the data recovery process with hard links
- 如果您的客户端不需要所有Time Machine数据，则不要构建也不保存Time Machine（\ Backups.backupdb）目录的映射。另外，您可以跳过文件夹 HFS+ Private Data and .HFS+ Private Directory Data_
Do not build and do not save the map of Time Machine (\Backups.backupdb) catalog if your client doesn’t need ALL Time Machine data. Also, you can skip folders HFS+ Private Data and .HFS+ Private Directory Data_ - 在Time Machine中建立并创建最后一个快照的映射（如果最后一个快照没有任何有效数据，则可能是先前快照的映射
Build and create a map of the last snapshot in Time Machine (maybe a map of previous snapshots if the last one doesn’t have any valid data - 使用地图压缩来估计已保存数据的实际大小(参考:使用PC-3000 Data Extractor怎么恢复$MFT位图上有坏扇区的数据？一文）
Use map compressing to estimate the real size of saved data
