Format of the Incremental Snapshot Files

A snapshot file (or directory file) is created during incremental backups (see Incremental Dumps). It contains the status of the file system at the time of the dump and is used to determine which files were modified since the last backup.

GNU tar version 1.26 supports three snapshot file formats. The first format, called format 0, is the one used by GNU tar versions up to 1.15.1. The second format, called format 1 is an extended version of this format, that contains more metadata and allows for further extensions. It was used by version 1.15.1. Starting from version 1.16 and up to 1.26, the format 2 is used.

GNU tar is able to read all three formats, but will create snapshots only in format 2.

This appendix describes all three formats in detail.

0. ‘Format 0’ snapshot file begins with a line containing a decimal number that represents a UNIX timestamp of the beginning of the last archivation. This line is followed by directory metadata descriptions, one per line. Each description has the following format:

             nfsdev inode name
   

   where:

   nfs

   A single plus character (‘+’), if this directory is located on an NFS-mounted partition, or a single space otherwise;
   

   dev

   Device number of the directory;
   

   inode

   I-node number of the directory;
   

   name

   Name of the directory. Any special characters (white-space, backslashes, etc.) are quoted.

1. ‘Format 1’ snapshot file begins with a line specifying the format of the file. This line has the following structure:

             ‘GNU tar-’tar-version‘-’incr-format-version
   

   where tar-version is the version number of GNU tar implementation that created this snapshot, and incr-format-version is the version number of the snapshot format (in this case ‘1’).

   Next line contains two decimal numbers, representing the time of the last backup. First number is the number of seconds, the second one is the number of nanoseconds, since the beginning of the epoch.

   Lines that follow contain directory metadata, one line per directory. Each line is formatted as follows:

             [nfs]mtime-sec mtime-nsec dev inode name
   

   where mtime-sec and mtime-nsec represent last modification time of this directory with nanosecond precision; nfs, dev, inode and name have the same meaning as with ‘format 0’.

2. ‘Format 2’ snapshot file begins with a format identifier, as described for version 1, e.g.:

             GNU tar-1.26-2
   

   This line is followed by newline. Rest of file consists of records, separated by null (ASCII 0) characters. Thus, in contrast to the previous formats, format 2 snapshot is a binary file.

   First two records are decimal numbers, representing the time of the last backup. First number is the number of seconds, the second one is the number of nanoseconds, since the beginning of the epoch. These are followed by arbitrary number of directory records.

   Each directory record contains a set of metadata describing a particular directory. Parts of a directory record are delimited with ASCII 0 characters. The following table describes each part. The Number type in this table stands for a decimal number in ASCII notation.

   Field	Type	Description
   nfs	Character	‘1’ if the directory is located on an NFS-mounted partition, or ‘0’ otherwise;
   mtime-sec	Number	Modification time, seconds;
   mtime-nano	Number	Modification time, nanoseconds;
   dev-no	Number	Device number;
   i-no	Number	I-node number;
   name	String	Directory name; in contrast to the previous versions it is not quoted;
   contents	Dumpdir	Contents of the directory; See Dumpdir, for a description of its format.

   Dumpdirs stored in snapshot files contain only records of types ‘Y’, ‘N’ and ‘D’.