Say I am running a full backup, followed by several differentials. As some time after the full backup, a file was deleted.

How can I see when exactly that happened?

Running "nsrinfo" on the specific savesets only shows the file being present in the full backup, unless it would have been modified later, which is when it would be shown again.

But how do I tell when exactly the file was deleted (e.g. between the 3rd and 4th differential)??


I would use "mminfo" to retrieve "nsavetime". After "nsavetime" has been retrieved feed that back into "nsrinfo". Here is a link that may help.


  • As I said, that doesn't show what has been deleted in the meantime. – Marki Dec 15 '17 at 14:10
  • It turns out you need to use nsrinfo with the -v option and look at the ndirentry elements. It will reparse the directory and show the new contents if they have changed. You will have to look yourself if what you're looking for is still present or not. You can NOT simply grep for the filename you're interested in. At most you can maybe grep the full path to the directory whose contents you believe have changed and then manually look at the single file objects. – Marki Dec 15 '17 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.