TIME MACHINE - How does it really work?

Question

Dear Mac users and Apple;
I am new to Mac. For most of my life I used Windows OS. One of the cool features on my new iMac 24'' is TM. In the past I used to use Norton Ghost for creating back ups and safeguarding my data.
Though there is a lot of info on www.apple.com and in the forums I can not find any satisfactory information about the true way of how Time Machine (TM) works.
Below I describe all my concerns, but in order to put them into perspective here is what I was used to on PC while using Norton Ghost. I would run a one time back up of my whole system drive (C:) and other drive (D:) which had my documents on it and then schedule regular back ups (weekly in my case). These were incremental back ups which only " added" the files which changed in the mean time. Of course, this method also meant that anything done between the back ups was at risk of being lost until next back up took place.
When I stated using TM, I assumed a lot of how it works based on my experience described above. However, I ran across this forum http://discussions.apple.com/thread.jspa?messageID=6096304&#6096304 and got pretty confused as to how it really works. I searched for explanations but all I find is us users guessing. I believe Apple should provide its customers with clear explanation and documentation how TM works.
If you read the long formum thread you will understand what I am talking about. If not here is a rough summary.
A guy backed up his data using TM, then after checking it is there he deleted the originals from the source drive only to find out later that the back ups were deleted from TM as well.
The thread goes on and these are the questions I have as a result - I kindly beg you to answer them for me:
1. TM does 1st back up of the whole Mac, at first - correct? This data stays until TM runs out of space on the back up drive, correct?
2.)TM does hourly back ups which are kept for 24 hrs (one day), then only a daily back up stays - which one out of the 24 is considered the daly back up? Or is it a separate back up?
3.)TM does daily back ups which stay for a month then are deleted?
4.)TM does weekly back up and this back up stays until TM runs out of space on the back up destination drive, correct? If yes, when does it take place?( 7days from the initial back up and then again each 7 days?
5.) If I create a file and then delete it before hourly back up stores it, it is not backed up at all, correct?
6.) If I create a file and then delete it once it was backed up by the hourly back up is it stored for 24 hours (one day) and then deleted?
7.) If I create a file and delete it once it was backed up by the daily backup, it stays for a month in the back ups of TM but then is deleted?
8.) If I create a file and it is backed up by the weekly back up, then is deleted - it resides in the weekly back up until TM runs out of space on the destination back up drive and deletes the original weekly back up, correct?
From this, if my assumptions above are right, it means that only files backed up by the weekly back up are kept until back up destination drive has space left. Then it would mean that it is important for me to know when the weekly back up takes place, so that I know that "now is the time and the files I have on my source drive now will stay in the target back up drive as long as it has space".
Further, it would mean that the hourly and daily back ups are kind of temporary back ups which give me the chance to restore the file within 24 hrs if backed up in the hourly back up, or restore it within one month if backed up by the daily back up. If backed up by the weekly back up, then it can be restored any time as long as the back up drive is not full. Is that correct?
IF I do a forced back up (Ctrl click on TM in the dock and then order it " Back up now") is this a back up which stays until back up external disk is full or is it a temporary back up (like the hourly and/or daily)?
Another issue is as follows: If I delete an application from my hard drive BUT it was backed up in the past by TM - can that application be launched automatically without first asking for my (users) permission from the TM's back up on the eternal hard drive? E.g. I install Adobe reader - it is backed up by TM. Then I uninstall it. Then, I download a PDF document, click it to open - does Adobe reader open from the TM back up? If NOT - great, that is how I expect it to work. If YES, then does it warn me about being opened from TM back up? YES it does warn me - great work apple. NO it does not - why? If the later is the case then if you exchange Adobe reader for spyware or malware or a virus, you have a vulnerability how viruses etc. can be reintroduced to system from TM back ups even after cleaned from the original hard disk. Please let me know how it really works.

Answer 1

1. TM does 1st back up of the whole Mac, at first - correct? This data stays until TM runs out of space on the back up drive, correct?
Respectively right and wrong. Out of all the hourly backups it makes, TM keeps only the first of each day for longer than 24 hours and one (presumably the first) of each week longer than one month. Any data which is not part of one of the retained backups is lost. Clearly this may happen long before the drive runs out of space and TM begins deleting the retained backups (oldest first).
2.)TM does hourly back ups which are kept for 24 hrs (one day), then only a daily back up stays - which one out of the 24 is considered the daly back up? Or is it a separate back up?
TM keeps only the first backup of each day for longer than 24 hours. When you bring up a daily backup in TM's browser, you will see on the big shiny black bar along the bottom not only the date but the precise time of the backup you are looking at.
3.)TM does daily back ups which stay for a month then are deleted?
One per week is retained (presumably the first but Apple isn't saying and I haven't seen that confirmed by anyone yet). The others are deleted.
4.)TM does weekly back up and this back up stays until TM runs out of space on the back up destination drive, correct? If yes, when does it take place?( 7days from the initial back up and then again each 7 days?
Don't know about timing. By analogy with the daily backups I would guess first of the week. But remember this is not a separate backup, it is one of the original hourly backups which survives the progressive culling process.
5.) If I create a file and then delete it before hourly back up stores it, it is not backed up at all, correct?
Correct.
6.) If I create a file and then delete it once it was backed up by the hourly back up is it stored for 24 hours (one day) and then deleted?
It is stored for at least 24 hours. If it was never on the first backup of any day it will not survive longer. Otherwise it will.
7.) If I create a file and delete it once it was backed up by the daily backup, it stays for a month in the back ups of TM but then is deleted?
If it was in the first backup of any day then it will be in the backup with that date so long as that backup is retained (at least 30 days and until the drive is full if that day is retained as the weekly backup).
8.) If I create a file and it is backed up by the weekly back up, then is deleted - it resides in the weekly back up until TM runs out of space on the destination back up drive and deletes the original weekly back up, correct?
If it is in the backup chosen as the weekly backup it will be available until that backup is deleted by TM for lack of space.
From this, if my assumptions above are right, it means that only files backed up by the weekly back up are kept until back up destination drive has space left. Then it would mean that it is important for me to know when the weekly back up takes place, so that I know that "now is the time and the files I have on my source drive now will stay in the target back up drive as long as it has space".
I wouldn't advise thinking like this. If you wish to retain long term a particular file TM is not the answer. You should separately archive it outside TM. As has been pointed out elsewhere, you could just copy it to the drive TM is running on, but outside TM's backup folder (however note that this will reduce the space available for TM's backups).
Further, it would mean that the hourly and daily back ups are kind of temporary back ups which give me the chance to restore the file within 24 hrs if backed up in the hourly back up, or restore it within one month if backed up by the daily back up. If backed up by the weekly back up, then it can be restored any time as long as the back up drive is not full. Is that correct?
Correct.
IF I do a forced back up (Ctrl click on TM in the dock and then order it " Back up now") is this a back up which stays until back up external disk is full or is it a temporary back up (like the hourly and/or daily)?
Good question. I have no reason to think that forced backups are priviledged in any way, but who knows? Anyone got any comment?
I install Adobe reader - it is backed up by TM. Then I uninstall it. Then, I download a PDF document, click it to open - does Adobe reader open from the TM back up?
Nothing in the backups is available to you until you have restored it. Interesting question is: if an application is restored, are any other files its original installer would have placed in the system and are needed to run it restored as well? One would like to think so but maybe that's too hard for TM? I would recommend that any major application that has been disinstalled be reinstalled from the original disks rather than relying on TM. Of course, if you've just accidently trashed an application file you can restore it from TM no problem.
Only after restoring it from TM can you use it.
Hope these comments help and anyone with more info adds their piece. TM is proving more confusing than it looked at first glance!