I am having problems backing up with Time Machine. It used to work well but for some time now I get the message that the backup "volume could not be found". Strangely, Time Machine recognises the drive when setting Time Machine preferences, just not when actually running a backup. I use a firewire drive to backup as I do not have a Time Capsule drive. My computer is a year old Intel MacBook.

This message comes up even when I try to backup to other drives.

I know it is a software problem, since I recently had to get my hard drive replaced and they couldn't save the data. When I tried to backup with Time Machine using just the newly installed system it worked fine.

However, when I restored my files and programs I got the same problem.

I tried removing TM preferences with no success. I have fixed permissions and repaired disks with no improvement. I repeat, this problem persists even when I try to backup to a different drive than the one I normally used.

Here is the message for the process in Console:

1/11/08 2:10:04 AM /System/Library/CoreServices/backupd[184] Backup requested by user
1/11/08 2:10:04 AM /System/Library/CoreServices/backupd[184] Starting standard backup
1/11/08 2:10:04 AM /System/Library/CoreServices/backupd[184] Volume at path /Volumes/MiniMax does not appear to be the correct backup volume for this computer. (Cookies do not match)
1/11/08 2:10:09 AM /System/Library/CoreServices/backupd[184] Backup failed with error: 18
1/11/08 2:10:16 AM /System/Library/CoreServices/backupd[184] Backup requested by user
1/11/08 2:10:16 AM /System/Library/CoreServices/backupd[184] Starting standard backup
1/11/08 2:10:16 AM /System/Library/CoreServices/backupd[184] Volume at path /Volumes/MiniMax does not appear to be the correct backup volume for this computer. (Cookies do not match)
1/11/08 2:10:21 AM /System/Library/CoreServices/backupd[184] Backup failed with error: 18

Anyone have any suggestions as to how I can get Time Machine working again? I am currently having to use a backup program that is not as neat as TM.

Are you using 10.5.5 now?

What is the 'Computer Name'? [in Sharing preferences]
i.e., are there any punctuation (like quotes... double or single)
or odd characters in the Computer Name?

-HI-

Yes I am using 10.5.5.

The computers name is <My Name's MacBook>. Would the apostrophe be causing some sort of problem, do you think? This is what the computer was always called, and it worked perfectly with Time Machine initially.

To reduce the size of the solution space, try running Time Machine from another user account on your same computer. If Time Machine can successfully backup the problem is isolated to your user account. If you do not have another account to test from you can create one by

1. Open System Preferences > Accounts
2. Click on the padlock at the bottom left of the accounts window and enter your password when prompted
3. Click on the plus (+) sign at the bottom of the Accounts list
4. Enter a name, short name, and password for the account (I use test for both name and shortname)
5. Click on the Create Account button
6. Quit System Preferences
7. On the Apple Menu logout of your current account
8. Logon to the new account

Another step to further isolate the problem would be to do a Safe Boot and run Time Machine from there. What I don't know and cannot test at the moment is whether or not Time Machine will run when you are in a safe boot. To start up into Safe Mode (to "Safe Boot"), do this:

1. Be sure the computer is shut down.
2. Press the power button.
3. Immediately after you hear the startup tone, press and hold the Shift key. &#8232;Tip: The Shift key should be held as soon as possible after the startup tone but not before.
4. Release the Shift key when you see the gray Apple and progress indicator (looks like a spinning gear).

One way to find out...

I created another user account and tried to run Time Machine. Same result, couldn't find backup drive, even though it had already recognised the drive during setup. All other user accounts were logged out.

I tried Time Machine after booting in safe mode. Same result.

I changed the computer's name in Sharing to omit apostrophes or any punctuation. Same result.

The description in Console referred to cookies. Does anyone know what these cookies might be and where? Obviously they are not internet browser cookies.

I might know now. I googled for [ "time machine" "cookies do not match" ] and found this thread:

• TimeMachine refuses to make backups (backup volume could not be found)

Apparently the cookie is a hidden file which Time Machine places at the root level of the backup disk.
Its name is your "MAC" hardware address (en0) with a leading dot [period] in the name to hide it.

The poster in that Discussions thread claims that file on his backup disk had wrong permissions.
I just checked, and mine is set to root:wheel & read-only...

ls -l@eO /Volumes/*/.0*
-r-------- 1 root wheel - 16 Dec 31 2007 /Volumes/myTMbackupVolume/.0a1b2c3d4e5f

Run that blue command and let's see what you get.

This is what I get after running the blue command:

-r-------- 1 steven staff - 16 23 Nov 2007 /Volumes/MiniMax/.0017f2e00396
-r-------- 1 steven staff - 16 29 Oct 18:16 /Volumes/MiniMax/.001b631daf6d
<Computer's Name>k:~ steven$

Hmm... two "cookies" on MiniMax, huh.
Is/was MiniMax being used as a Time Machine backup for another Mac?

Either way, it will be useful to verify your current computer's hardware address at this point:

ifconfig en0 |awk '/ether/ { print $2 }'

As far as permissions go, it might be handy to know your id# (probably 501, but let's verify that)
and also some of the actual perms (including ACLs) inside /Volumes. So, run these two commands
(in addition to ifconfig above):

id -un; id -u

sudo ls -aeiklO /Volumes

That last one with sudo will ask for your admin password (which will not be printed onscreen).
I use sudo for that simple listing just to see if any "unknown" ownerships appear (uid/gid = 99).
Not that they'd matter to any great extent. But, having full info never hurts when troubleshooting.

--

It could be that deleting one of those cookies is called for. Or maybe changing the ownerships/perms
on them or perhaps even the backup disk itself. Many users have no trouble when they're the "owner"
of their external drives, but I'm a believer in letting system (root) own the disk itself, and get needed
access via group assignment (either admin or staff).

We'll see what's what, after looking at those three commands' outputs.

After running

ifconfig en0 |awk '/ether/ { print $2 }'

I get:

00:1b:63:c0:53:db
<computers-name>:~ steven$

After running

id -un; id -u

I get:

steven
501
<computers-name>:~ steven$

After running

sudo ls -aeiklO /Volumes

I get:

total 4
22411 drwxrwxrwt@ 4 root admin hidden 136 7 Nov 15:10 .
2 drwxrwxr-t 35 root admin - 1258 5 Nov 12:48 ..
5429840 lrwxr-xr-x 1 root admin - 1 6 Nov 19:07 MacBook HD -> /
2 drwxr-xr-x@ 32 _unknown _unknown - 1156 7 Nov 01:56 MiniMax
<computers-name>:~ steven$

Recall my other question:

• Is or was MiniMax being used as a Time Machine backup for another Mac?

It helps if we know which (is or was?). Because —if the other Mac is gone forever— then
simply deleting the .0017f2e00396 file just might do the trick.



Okay, so then this is the right file for that Mac:
-r-------- 1 steven staff - 16 29 Oct 18:16 /Volumes/MiniMax/.001b631daf6d


WAIT whoops... they don't match!!! {i'll be back}

Don't know why they're so close... but they don't match:

00:1b:63:c0:53:db
.001b631daf6d

How did a wrong (but very similar) number get in there? (Has this Mac been to a repair shop?)
And ignoring that... why doesn't Time Machine simply create a new file that does match???

Also... what did you mean here??

Is this "firewire drive" hooked directly... or through a network somehow?


Never been in this situation before, but given my limited knowledge of what all Time Machine
does behind the scenes... I would either move those two existing cookies elsewhere and hope
that Time machine makes a new one (and who knows what the side effects of that might be...
a full backup?) -- or -- try renaming the .001b631daf6d file to .001b63c053db idunno.

Does this produce any output for you?
ifconfig |grep -C2 -E '(00:1b:63:1d:af:6d|00:17:f2:e0:03:96)'

Thanks Hal for all the time you're putting into this.

When I enter

ifconfig |grep -C2 -E '(00:1b:63:1d:af:6d|00:17:f2:e0:03:96)'

I get:

inet6 fe80::21b:63ff:fe1d:af6d%en1 prefixlen 64 scopeid 0x4
inet 10.1.1.2 netmask 0xffffff00 broadcast 10.1.1.255
ether 00:1b:63:1d:af:6d
media: autoselect (100baseTX <full-duplex>) status: active
supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control> none
computers-name:~ steven$

The firewire drive wasn't used to backup another computer, however I have had a new hard drive put into this one recently, and I have also had to restore the system a few times in the past.

However, the problem with backing up with Time Machine has been going on for some months. Also, Time Machine was having the same problem when I tried to use another firewire drive which had never had a TM backup.

The reason I mentioned I use a firewire drive was because I wondered whether it was a firewire issue, as my wireless network seems to work fine, so I supposed a Time Capsule solution might have overcome the problem. I now doubt that this is the case.

When the computer came back from getting a new hard drive, before I had changed anything on the computer, I gave TM a try and it began to backup with no problems. I hoped that the problem had been solved!. But after I had restored the computer from a backup the same problem returned.

Any ideas?

In that case, the ".001b631daf6d" file is the correct one to keep.
However, this result (from your earlier reply) is most puzzling:

In fact... if there wasn't a typo or copy/paste error on your part,
this could be a symptom of the "cookies don't match" problem.
Unless... [see below]


That might explain the extraneous ".0017f2e00396" file.
[though, i thought it would take a logic board replacement to bring about a new hardware address... idunno]


Yeah... i wouldn't expect that to produce any problem either.
It may well be something so deep that only an expert can "find" it.
You might want to consider doing a clean install if no other solution presents itself.


Network? Are you backing up to MiniMax over a network?
If so, have you tried connecting this firewire disk directly to your Mac?
Wait... wireless? So then Time Machine is talking through your AirPort address (en1)?

If so, it's time to lose the fancy filtering... please
post your entire info with this command:

ifconfig



I'd say we can safely nuke that extra cookie and see what happens.
Do a restart afterward, just to be sure its existence wasn't cached.

rm -vf /Volumes/MiniMax/.0017f2e00396

I tried

rm -vf /Volumes/MiniMax/.0017f2e00396

but the result was the same.

This is the information from Console from when I set the drive to back up to when the backup failed.

8/11/08 4:11:09 PM System Preferences[236] Time Machine failed to get MAC address for machine.
8/11/08 4:11:16 PM /System/Library/CoreServices/backupd[240] Backup requested by user
8/11/08 4:11:16 PM /System/Library/CoreServices/backupd[240] Starting standard backup
8/11/08 4:11:16 PM /System/Library/CoreServices/backupd[240] Volume at path /Volumes/MiniMax does not appear to be the correct backup volume for this computer. (Cookies do not match)
8/11/08 4:11:21 PM /System/Library/CoreServices/backupd[240] Backup failed with error: 18

As for the other matters: no, I use my network for internet and printer. The firewire drive for backups is connected directly to the computer through the firewire port. Sorry if this has been confusing.

After running

ifconfig

I get:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fd39:6a92:a7b7:e6a2:21b:63ff:fe1d:af6d prefixlen 128
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::21b:63ff:fe1d:af6d%en1 prefixlen 64 scopeid 0x4
inet 10.1.1.2 netmask 0xffffff00 broadcast 10.1.1.255
ether 00:1b:63:1d:af:6d
media: autoselect (100baseTX <full-duplex>) status: active
supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control> none
fw0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 2030
lladdr 00:19:e3:ff:fe:a1:50:54
media: autoselect <full-duplex> status: inactive
supported media: autoselect <full-duplex>
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::21b:63ff:fec0:53db%en0 prefixlen 64 scopeid 0x6
inet 10.0.1.4 netmask 0xffffff00 broadcast 10.0.1.255
ether 00:1b:63:c0:53:db
media: autoselect status: active
supported media: autoselect
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::21c:42ff:fe00:1%en2 prefixlen 64 scopeid 0x7
inet 10.211.55.2 netmask 0xffffff00 broadcast 10.211.55.255
ether 00:1c:42:00:00:01
media: autoselect status: active
supported media: autoselect
en3: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::21c:42ff:fe00:0%en3 prefixlen 64 scopeid 0x8
inet 169.254.73.94 netmask 0xffff0000 broadcast 169.254.255.255
ether 00:1c:42:00:00:00
media: autoselect status: active
supported media: autoselect
Computers-Name:~ steven$

There should not be any errors in the information in previous posts. I copied and pasted them straight from Console.

I've just remembered something else I hadn't yet mentioned. Many months ago we had a lightening strike which nuked the ethernet port. That was when the TM backup started to go awry, and why I thought it might be a firewire port problem. The logic board was replaced, which solved the ethernet problem. There actually wasn't any problem with the firewire drive, which mounted and operated perfectly well, or the firewire port either.

I'm still convinced that it is a software problem. As I mentioned, the TM backup began correctly after my hard drive replacement and before I had restored from backup.

I would prefer to avoid a clean install. I have just got everything back again, and tested all my programs and got rid of residual bugs, and this was from a backup! It would take days to install everything from scratch, and I do need to do some work sometimes! I really wouldn't be able to face a clean installation until the new year.

Thanks for the details.

It just dawned on me that this cookie deal is strange... in that: we (most of us, including you
thank heavens) use the FireWire port (fw0) to connect to the Time Machine backup disk... yet,
this cookie uses the Ethernet port (en0) address value as a means to "uniquely identify" the
hardware device it's connected to. Adding to this confusion --for me anyway-- is the way the
term "Ethernet Address" is overloaded. Witness:

sudo networksetup -listallhardwareports

Hardware Port: Bluetooth
Device: Bluetooth-Modem
Ethernet Address: N/A

Hardware Port: Ethernet
Device: en0
Ethernet Address: 00:1b:2c:3d:4e:5f

Hardware Port: FireWire
Device: fw0
Ethernet Address: 00:1e:52:ff:fe:3b:77:24

Hardware Port: AirPort
Device: en1
Ethernet Address: 00:1e:52:a2:49:01


See that? ... just about everything has an "Ethernet Address", including the FireWire port.
So... then why isn't the fw0 number used, when Time Machine is connected that way?

Anyway, a few things strike me about your ifconfig output (did you say "lightening" or "lightning"?)
1) in yours, en1 gets listed before en0... not so on any Mac I have here.

2) in yours, en1 has all sorts of fancy words like <full-duplex> after it,
whereas your en0 looks rather bare. Mine is the opposite. (your en0 appears inactive)

3) you've got an en2 and an en3 ? (I don't... but anyway).

It seems like your en1 is the top dog there... so I'm wondering if the order of your services
has been modified and if that could be the issue. [we need some networking gurus around here.]
Here is mine, as I set it up to be (using System Preferences->Network->Set Service Order popup menu):

sudo networksetup -listnetworkserviceorder

An asterisk (*) denotes that a network service is disabled.
(1) Built-in Ethernet
(Hardware Port: Ethernet, Device: en0)

(2) AirPort
(Hardware Port: AirPort, Device: en1)

(3) Bluetooth
(Hardware Port: Bluetooth, Device: Bluetooth-Modem)

(4) External Modem
(Hardware Port: External Modem, Device: usbmodem)


As both my results above show: en1 is traditionally the AirPort port.
Not sure what to make of all this. But, summarizing your numbers:

en1 = ether 00:1b:63:1d:af:6d
en0 = ether 00:1b:63:c0:53:db

Those are your Ethernet Addresses for en0 and en1, and for some reason
en1 seems to have gotten into Time Machine's business more than I would
expect (for a Mac directly connected to a FireWire... not using a network).





Right... well, this gets back to my first paragraph. Sure, the FireWire part is all fine... and, new logic board?
Great.
But Time Machine seems to be designed to want the en0 address value for its cookie... and it's starting to
look and sound like your en0 is fried in some way which is preventing that.

Don't want to reinstall... I understand. But this problem must certainly be rare... and I don't know if
anyone can say "oh yeah, you need to do x y and z".

I could take a wild shot and say try renaming that cookie to match the en0 number.
But I have no idea if that will actually "work":

mv /Volumes/MiniMax/.001b631daf6d /Volumes/MiniMax/.001b63c053db

Instead... run those bold blue commands above first, and let's see what they look like maybe.

idunno. [really]

"Lightning" was what I said, but it seems "lightening" was what my fingers typed. Must be the strain!

After running:

sudo networksetup –listallhardwareports

I get:

Hardware Port: Bluetooth
Device: Bluetooth-Modem
Ethernet Address: N/A

Hardware Port: Ethernet
Device: en1
Ethernet Address: 00:1b:63:1d:af:6d

Hardware Port: Ethernet Adaptor (en3)
Device: en3
Ethernet Address: 00:1c:42:00:00:00

Hardware Port: Ethernet Adaptor (en2)
Device: en2
Ethernet Address: 00:1c:42:00:00:01

Hardware Port: FireWire
Device: fw0
Ethernet Address: 00:19:e3:ff:fe:a1:50:54

Hardware Port: AirPort
Device: en0
Ethernet Address: 00:1b:63:c0:53:db

VLAN Configurations


After running:

sudo networksetup -listnetworkserviceorder

I get:

An asterisk (*) denotes that a network service is disabled.
(1) Built-in-Ethernet
(Hardware Port: Ethernet, Device: en1)

(2) External Modem
(Hardware Port: External Modem, Device: usbmodem)

(3) Bluetooth
(Hardware Port: Bluetooth, Device: Bluetooth-Modem)

(4) Built-in FireWire
(Hardware Port: FireWire, Device: fw0)

(5) wireless
(Hardware Port: wireless, Device: en4)

(6) Parallels Host-Guest
(Hardware Port: Ethernet, Device: en1)

(7) Parallels NAT
(Hardware Port: Ethernet Adaptor (en2), Device: en2)

(8) AirPort
(Hardware Port: AirPort, Device: en0)

(9) Parallels Host-Guest
(Hardware Port: Ethernet Adaptor (en3), Device: en3)

It seems that at least some of the ethernet confusion is caused by Parallels PC emulation software setting up virtual connections. Strange.

Again, I don't think this is the problem, as TM used to work fine despite Parallels, though it does seem odd that fw should have an ethernet address.

I don't think it's a fried something either, since the TM backup began when I tested it before I had restored my software after the new hard drive.

I tried running:

mv /Volumes/MiniMax/.001b631daf6d /Volumes/MiniMax/.001b63c053db

but it made no difference.

Thanks for all the time you have given to this, Hal. I do appreciate it.

But it looks like a clean install may be the only answer, unless you can think of something new?

I still find this message the most telling:
8/11/08 4:11:09 PM System Preferences[236] Time Machine failed to get MAC address for machine.

That's System Preferences saying Time Machine failed to "get" the MAC (ethernet hardware) address... and
then -- after that -- backupd (Time Machine) complains the cookies don't match. [but it missed getting one of
them... so, how can it compare values correctly?]

And I don't see why/how your AirPort got bound to en0, instead of en1 where it usually is... but
maybe that part doesn't really matter.

It might be worth moving every plist in the local /Library/Preferences/SystemConfiguration/ folder
onto your desktop and restarting. All your network settings will be lost (or should be), and you'll
have to reconfigure a bunch of stuff.

Or maybe just go into System Preferences->Network and rearrange stuff with the "Set Service Order..."
menu item... which is on the 'action' popup menu (the gear icon).

I don't understand what's going on, but it seems to me that:
"System Preferences saying Time Machine failed to get MAC address for machine"
is about as close to the problem's source as we have been able to get so far.

If/when you ever solve this (other than buying a new MacBook)... do please post back with that info.

Just install this kext, repair permissions, reboot and, probably, you will be happy.

http://www.adrive.com/public/8045204b51ee1183c411d0bf209f1b0015ea37131ff34de5744371784e16c246.html


MODERATOR'S NOTE: Be aware that clicking on the above link will immediately initiate a download of a third party kernel extension.

[note: the smiley seems creepy in this context]
What exactly is that... some developer version?
Or did you (or some other 3rd-party) "customize" it?
The package fails code sign verification, BTW... so
it (supposedly) isn't Apple "authorized."

Perhaps you could supply some details.

This seems to be an online storage and backup service. All I want is to get my Time Machine working again.

I happened upon a hidden file (on my HD) today,
and you'll never guess what its name is :    .TimeMachine.Cookie
Don't know squat about it, but -- on my Mac -- its 16-byte contents exactly match the ".0*" file on the backup disk!!!

So... let's just see how well yours match up:
ls -l /var/db/.TimeMachine.Cookie /Volumes/*/.0*
-r-------- 1 root wheel 16 Dec 31 2007 /Volumes/L_d100g/.001a2b3c4d5e
-r-------- 1 root wheel 16 Dec 31 2007 /var/db/.TimeMachine.Cookie

sudo diff /var/db/.TimeMachine.Cookie /Volumes/*/.0*

Ideally, that last command (diff) should produce no output at all (plus an exit code = 0).
If there is [suitable] output from diff, then perhaps there's still some hope left here.

--

Hoping you did indeed do the "rm -vf /Volumes/MiniMax/.0017f2e00396" as stated above. Else,
if there are two ".0*" items on your backup disk, then diff will complain about an 'extra operand'.

After entering

ls -l /var/db/.TimeMachine.Cookie /Volumes/*/.0*

I get

ls: /var/db/.TimeMachine.Cookie: No such file or directory
-r-------- 1 steven staff 16 29 Oct 18:16 /Volumes/MiniMax/.001b63c053db

After entering

sudo diff /var/db/.TimeMachine.Cookie /Volumes/*/.0*

I get

diff: /var/db/.TimeMachine.Cookie: No such file or directory

Not sure what this means. It doesn't seem to be what you were expecting.

By the way, I did indeed run

"rm -vf /Volumes/MiniMax/.0017f2e00396" and restarted.

Just a thought: Did you type those things or did you paste them? Pasting is more reliable because you'll avoid typos. It's not always obvious, for example, where spaces occur.

They were all pasted directly from Hal's posts.

Alllllll-righty then.

Try a:
ls -l /var/db/.Time*
[just to see if a hidden file named ".TimeMachine.Results.plist" shows up.]

If you want to skip ahead... my next suggestion will be to create the missing file:
sudo cp -v /Volumes/MiniMax/.001b63c053db /var/db/.TimeMachine.Cookie

When that succeeds, redo the ls and diff from before... and post all text.
Restart and test. (breathing optional)