In Documents->Parallels, I have three VM files: one each for Windows XP, Windows 7, and Windows 10.

I just found out the latter two are not being backed up. I found this out because I was checking my Time Machine backup (I run QRecall daily and Time Machine weekly) and it's not backing them up, either.

By "not backing up", I mean that the Win 7 and Win 10 VM files don't appear in either the Time Machine or QRecall interface when browsing the backups. In the case of Time Machine, I can look in the folder hierarchy of the backup and they're not there either.

Neither program has any exclusions or conditions set that would preclude the backup of these files, and looking at the permissions on the files in Terminal, all three VMs have the same permissions. My current guess is that the problem might be related to the extended attributes for each file. Suggestions?

David,

It's likely that the cause is one of two reasons.

First, both Time Machine and QRecall exclude certain items. Both have an internal list of items that are never backed up along with a mechanism to arbitrarily mark items that should be excluded. For Time Machine, this "do not backup" attribute is a service of the operating system. Applications can, for example, mark files or folder that should not be backed up. Typically this is because they contain superfluous or transient data (like a video edit's render files).

Time Machine will always exclude items marked as "do not backup" by the operating system. QRecall will exclude them too, if you have the "Exclude items excluded by Time Machine" option set in the archive's settings. When this option is set, QRecall uses the same OS attribute that Time Machine does to exclude items (in addition to any other QRecall exclusion settings you might have set).

Since these two VM files don't appear anywhere in QRecall, I'm assuming that this is your issue. The solution/test (for QRecall) is to turn off the "Exclude items excluded by Time Machine" setting. QRecall will stop using the operating system's exclusion attribute to make capture decisions.

The down side of this change is that the operating system does mark a lot of things that really don't need to be backed up, and now QRecall will ignore that advice and capture them anyway. If this archive only captures your virtual machine files and nothing else, then turning off this setting won't capture too many superfluous files. If this archive also captures the rest of your system, then I would suggest splitting your archive into two:

- An archive with the "excluded by Time Machine" setting on that captures your entire system, but excludes your VM files.
- A second archive with "excluded by Time Machine" setting turned off that captures just your VM files.

This has other advantage too, such as the ability to trigger a re-capture of your VM files when you quit your VM software, or prevent QRecall from trying to capture your VM files while your VM software is running (which will undoubtedly result in an incomplete capture of your VM state).

The second possible issue is how OS X tracks filesystem changes. Both QRecall and Time Machine depend on the filesystem change history to quickly determine what portions of the filesystem have been modified. There are, however, well-known limitations in how the filesystem change history works that makes it blind to certain kinds of changes, and there are a few VM software packages out there are are notorious for making just those kinds of changes. The result is that neither Time Machine nor QRecall see the changes in your VM.

QRecall combats this deficiency with two features. First, it has a "Filesystem Change History Trust" setting (in the Advanced settings pane). Periodically, it will ignore the filesystem change history and exhaustively scan the entire folder hierarchy looking for modified items. The default interval is once a week. You can edit this interval, or set the "Deep Scan" option in the capture action. The later will force QRecall to perform an exhaustive search for changes every time that capture is run. The capture option was specifically designed to let you create a separate capture action for just your VM files that always ignores filesystem change history, while your other captures will continue to take advantage of it.

But since you say that your VM files are not captured at all, I suspect that the filesystem change history issue isn't your problem (although you might discover that it's a problem once you start capturing your VM files).

Based on this information, I exercised by Google-Fu and found this handy command:

sudo mdfind "com_apple_backup_excludeItem = 'com.apple.backupd'"

The first two items on the list were the VM files that aren't getting backed up. I see that Parallels has a setting for VMs labeled "Do not back up with Time Machine", and turning that off removes the files from the list. So that was the problem.