Format of the Incremental Snapshot Files

A snapshot file (or directory file) is created during incremental backups (see section Using tar to Perform Incremental Dumps). It contains the status of the file system at the time of the dump and is used to determine which files were modified since the last backup.

GNU tar version 1.35 supports three snapshot file formats. The first format, called format 0, is the one used by GNU tar versions up to and including 1.15.1. The second format, called format 1 is an extended version of this format, that contains more metadata and allows for further extensions. It was used by alpha release version 1.15.90. For alpha version 1.15.91 and stable releases version 1.16 up through 1.35, the format 2 is used.

GNU tar is able to read all three formats, but will create snapshots only in format 2.

This appendix describes all three formats in detail.

2. ‘Format 0’ snapshot file begins with a line containing a decimal number that represents a UNIX timestamp of the beginning of the last archivation. This line is followed by directory metadata descriptions, one per line. Each description has the following format:

   [nfs]dev inode name
   

   where:

   nfs

   A single plus character (‘+’), if this directory is located on an NFS-mounted partition, otherwise empty.

   (That is, for non-NFS directories, the first character on the description line contains the start of the dev field.)

   dev

   Device number of the directory;

   inode

   I-node number of the directory;

   name

   Name of the directory. Any special characters (white-space, backslashes, etc.) are quoted.

3. ‘Format 1’ snapshot file begins with a line specifying the format of the file. This line has the following structure:

   ‘GNU tar-’tar-version‘-’incr-format-version
   

   where tar-version is the version number of GNU tar implementation that created this snapshot, and incr-format-version is the version number of the snapshot format (in this case ‘1’).

   Next line contains two decimal numbers, representing the time of the last backup. First number is the number of seconds, the second one is the number of nanoseconds, since the beginning of the epoch.

   Lines that follow contain directory metadata, one line per directory. Each line is formatted as follows:

   [nfs]mtime-sec mtime-nsec dev inode name
   

   where mtime-sec and mtime-nsec represent last modification time of this directory with nanosecond precision; nfs, dev, inode and name have the same meaning as with ‘format 0’.

4. ‘Format 2’ snapshot file begins with a format identifier, as described for version 1, e.g.:

   GNU tar-1.35-2
   

   This line is followed by newline. Rest of file consists of records, separated by null (ASCII 0) characters. Thus, in contrast to the previous formats, format 2 snapshot is a binary file.

   First two records are decimal integers, representing the time of the last backup. First number is the number of seconds, the second one is the number of nanoseconds, since the beginning of the epoch. These are followed by arbitrary number of directory records.

   Each directory record contains a set of metadata describing a particular directory. Parts of a directory record are delimited with ASCII 0 characters. The following table describes each part. The Number type in this table stands for a decimal integer in ASCII notation. (Negative values are preceded with a "-" character, while positive values have no leading punctuation.)

   Field	Type	Description
   nfs	Character	‘1’ if the directory is located on an NFS-mounted partition, or ‘0’ otherwise;
   timestamp_sec	Number	Modification time, seconds;
   timestamp_nsec	Number	Modification time, nanoseconds;
   dev	Number	Device number;
   ino	Number	I-node number;
   name	String	Directory name; in contrast to the previous versions it is not quoted;
   contents	Dumpdir	Contents of the directory; See section Dumpdir, for a description of its format.

   Dumpdirs stored in snapshot files contain only records of types ‘Y’, ‘N’ and ‘D’.

   The specific range of values allowed in each of the Number fields depends on the underlying C datatypes as determined when tar is compiled. To see the specific ranges allowed for a particular tar binary, you can use the ‘--show-snapshot-field-ranges’ option:

   $ tar --show-snapshot-field-ranges
   This tar's snapshot file field ranges are
      (field name      => [ min, max ]):
   
       nfs             => [ 0, 1 ],
       timestamp_sec   => [ -9223372036854775808, 9223372036854775807 ],
       timestamp_nsec  => [ 0, 999999999 ],
       dev             => [ 0, 18446744073709551615 ],
       ino             => [ 0, 18446744073709551615 ],
   

   (This example is from a GNU/Linux x86_64 system.)

This document was generated on August 23, 2023 using texi2html 5.0.