Is there a way to see if a macbook had a time machine backup done?
I was wondering if there's any way to see if someone did a Time Machine backup on a macbook.
From what I'm gathering you want to see if anyone accessed your computer to make a backup of it. I found this thread which might answer your question for how to retrieve the time machine backup logs from your Mac. Run the following command in Terminal
log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info
which will show the most recent backups made. There is one change needed since log files can show activity of another account, if your Mac doesn't have your log in trusted as an administrator, you need that permission to do the search. Just add sudo
to the above command as shown below:
sudo log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info
I think this might help:
The Time Machine Mechanic (T2M2) – a quick but thorough check of Time Machine backing up
It’s a free tool from Howard Oakley, who describes it this way:
T2M2 analyses your logs to discover whether Time Machine backups have been running normally, reporting any worrying signs or errors. You do not need to be able to read or understand logs to be able to check for problems now. Reports deep event traversals, compaction of volumes, regularity of backups, and more. Detailed Help book explains results and advises. New version enhances reporting of free space on backup volumes.
That’s where I’d start!