TM backs up way more than it "Prepares" to back up.

Question

I've been using Time Machine without problem for some weeks now.
Today I plugged the firewire drive into my Powerbook and opened up Time Machine preferences to watch what happened (as is my practice). It did a "Preparing" phase for a normal period of time and then said it was going to back up roughly 7 MB of data. This matched my expectations.
However, when the progress bar and numeric indicator both said it had gotten that far it just kept going!
The progress bar remained at 100% and BOTH the numeric target of how much to backup and the count of how much had in fact been transferred increased together.
By the time it reached 1 GB I decided to check the Console. There were no error messages in the Console. It did however have one oddity. It said that a backup had been requested due to disk insertion (which was correct), and that a "standard" backup had started. And then, shortly after that, there was ANOTHER message that a backup had been requested by the automatic scheduler.
That may be nothing but it was the only odd thing in there.
The backup was still going -- and rather more slowly than I'm used to for large TM backups.
Eventually it completed, having transferred 4.3 GB -- way more than I expected but of course by no means anywhere close to a full system backup.
I checked the Console again and found the normal messages: 4.3 GB transferred, no pre- or post-backup thinning required, nothing deleted.
I did a Disk Utilities Verify Disk on both the main hard drive and the Time Machine drive, as well as a Repair Permissions on the main hard drive. No problems reported.
I rebooted and commanded another backup. This one completed normally having transferred under 1 MB.
So again, the only odd thing I've been able to find was the Console report of the automatic scheduler having requested a backup while a backup was already in progress due to disk insertion.
I poked around in the Time Machine itself and could find no problems with this extra large backup, the one I did after it, or any of the prior history.
So there appears to be no actual damage done, although the size of that backup remains a mystery -- as does why it didn't show up as the target amount after the "Preparing" phase.
And oh, yes, the actual space consumed on my main hard drive has not changed. So I haven't suddenly acquired 4 GB of new stuff somehow. Which means the 4.3 GB backed up must have represented changes of some sort as opposed to new stuff.
I thought that Time Machine might have somehow picked up stuff from another Mac on the LAN, but the Time Machine display does not let you select the shared portion of a networked computer so apparently not.
Anyway, another TM mystery.
--Bob

Answer 1

No I've done multiple, hourly incremental backups since the QuickTime update. The size of the first of those backups after applying the update was reasonable given the size of the update and the files likely altered. The incrementals after that were all modest and thoroughly in accordance with the sorts of activities I had been doing.
(For folks reading this after the fact, the backup in question happened BEFORE Apple came out with the 2007-9 security update released later that same day. Also, I've got one virtual environment file -- a Virtual PC file -- but that's around 10 GB so it couldn't have been party to this 4.3 GB mystery backup. And it wasn't touched/modified since the prior incremental anyway.)
The weird thing is the idea that "Preparing" came up with a figure that matched my expectations (around 7 MB), but then the actual backup blasted right past that and just kept climbing to 4.3 GB.
Also, there wasn't anything that I was doing during that backup that might have invalidated the "Preparing" results. I specifically wanted to sit there and watch it complete the backup after I plugged in the firewire disk. I've been looking for cases where the backup appears to get hung up during the data transfer, only to complete after an unexplained pause of a minute or so. So I plugged in the disk, opened Time Machine preferences to see what happened, and just sat there watching it.
In this case the approx. 7 MB declared by "Preparing" transferred without any significant pauses and then I marveled as it just kept going. I didn't actually do anything until it crossed 1 GB, at which point I went to open the Console to see if it had any explanation.
Another significant factor, I think, is that the speed of the transfer was fairly slow. I've done multiple GB Time Machine backups (as when that Virtual PC environment file changes), so I have a feel for how fast this firewire 800 drive will do that. And this 4.3 GB transfer was quite a bit slower.
If I had to guess, I'd say that Time Machine was doing some re-writing of stuff FROM the Time Machine disk TO the Time Machine disk (so that the firewire speeds affected the data transfer twice). But there was nothing in the Console logs that suggest anything like that was happening. Alternatively Time Machine may have been reading data across the network and transferring it to the Time Machine disk. That too would account for the speed difference. But I can find no files in the Time Machine histories indicating that anything like that might have happened.
--Bob