how does time machine work? code example

Example: time machine

To see which files are being copied:
sudo fs_usage -wf filesys backupd | grep HFS_update