Time Machine (software)
How it works
Every hour, a daemon process mounts the backup volume (a HFS+ formatted sparse disk image), scans the filesystem for changes, and backs them up. Changes are detected via the FSEvents framework which was introduced in Leopard; when there is no information available, the backup process does a full filesystem scan.
For each backup, a new directory tree is created on the backup volume, mirroring the current state of the filesystem. Modified files are added incrementally; non-modified files are hard-linked from the previous successful backup tree. Whole directories that are not modified are hard-linked at the directory level (directory hardlinks are a new feature introduced by Apple in the HFS+ filesystem).
After a successful backup, some old backups may be purged. The goal of the purge process is to keep no more than: hourly backups of the last 24 hours, daily backups of the last week, and weekly backups for as long as there is space left on the backup volume.