Appendix D Format of the Incremental Snapshot Files

A snapshot file (or directory file) is created during incremental backups (see Incremental Dumps). It contains the status of the filesystem at the time of the dump and is used to determine which files were modified since the last backup.

GNU tar version 1.15.90 supports two snapshot file formats. The first format, called format 0, is the one used by GNU tar versions up to 1.15.1. The second format, called format 1 is an extended version of this format, that contains more metadata and allows for further extensions.

‘Format 0’ snapshot file begins with a line containing a decimal number that represents the UNIX timestamp of the beginning of the last archivation. This line is followed by directory metadata descriptions, one per line. Each description has the following format:

     [nfs]dev inode name

where optional nfs is a single plus character (‘+’) if this directory is located on an NFS-mounted partition, dev and inode are the device and inode numbers of the directory, and name is the directory name.

‘Format 1’ snapshot file begins with a line specifying the format of the file. This line has the following structure:

     ‘GNU tar-’tar-version‘-’incr-format-version

where tar-version is the version of GNU tar implementation that created this snapshot, and incr-format-version is the version number of the snapshot format (in this case ‘1’).

The following line contains two decimal numbers, representing the time of the last backup. First number is the number of seconds, the second one is the number of nanoseconds, since the beginning of the epoch.

Following lines contain directory metadate, one line per directory. The line format is:

     [nfs]mtime-sec mtime-nsec dev inode name

where mtime-sec and mtime-nsec represent the last modification time of this directory with nanosecond precision; nfs, dev, inode and name have the same meaning as with ‘format 0’.