Sometimes, files or folders go crazy. An innocent document keeps crashing an app, or breaking a backup. No matter what we look at, we can’t find anything wrong with the file(s) or folder(s), and usually just throw them away, if we can afford to. But in many of these cases, the data in the document are fine, it’s the file’s extended attributes (xattrs) which are causing the problem. That’s an issue which is easily fixed.

What sort of problems?

They’re usually weird, and can’t be explained by anything else. They include:

• files which repeatedly crash the mdworker metadata indexer daemon
• files which cause backup software to fail or crash
• image files which can’t be opened, or which cause apps to crash
• files which get marked as being in Gatekeeper quarantine when they haven’t been downloaded
• files which are reported by apps as being damaged or corrupted
• files which seem much larger than the data they contain.

General checks to perform first

Any of these problems could readily be explained by the data in the file(s) being corrupted, if for example a disk error had occurred. When you have identified one or more files which you think are responsible for the problem, make copies of them (in APFS ensure that these are proper copies and not mere clones).

Then run Disk Utility on the drive to apply First Aid. That should ensure that the drive and its contents are good. Presumably that should also fix any errors in the volume metadata, which contains extended attributes.

Removing xattrs using xattred

If you don’t want to work through this in Terminal, download and install my free xattred xattr editor (from Downloads).

Open the app, click on the Open button, and select the offending file. xattred will then display all the file’s extended attributes in the two lower panes.

Select the type of the xattr which you want to remove, in the lower of those two panes, copy and paste it into the text box next to the Add xattr and Remove xattr buttons.

Click on the Remove xattr button, and the contents of the window will refresh, and confirm that it has been removed successfully. You can then quit the app.

Knowing which xattr(s) to remove is educated guesswork. You might wish to compare the xattrs shown for your file with examples listed in my section on xattrs here. Any xattr which should be small and in plain text, which is shown as being large and in binary, should be a suspect.

Removing xattrs in Terminal

You can obtain a detailed folder listing of files with their list of xattrs using
ls -l@
which may help you home in on the file. Once you know which it is, use
xattr -l filename
to display all the xattrs for the file or folder named filename.

When you know which xattr to delete, use
xattr -d xattrtype filename
to delete the xattr of type xattrtype from the file named filename, or
xattr -c filename
to delete all the xattrs for the file named filename.

Can I copy a ‘good’ xattr to my file?

You may be able to, using the xattr command in Terminal, but you could easily make matters worse, not better. Because in most situations xattrs are optional, and should make things easier, most apps are used to coping with missing xattrs. However, when some find a xattr which appears incorrect, that is more likely to cause problems. So in general, you are better to remove a damaged or incorrect xattr, and see if that solves the problem.

The ‘official’ way to copy a xattr from a source to a file is:
xattr -wx xattrtype "`xattr -px xattrtype sourcefile`" destfile
which copies a xattr of type xattrtype from sourcefile to destfile.

You can use xattred to add xattrs in two circumstances: xattred is the only tool which can add a valid Gatekeeper quarantine xattr to a file, to force a full Gatekeeper check; to do that, open the file you want to attach the xattr to, and click the Add quarantine xattr button.

You can also use xattred to add any xattr which uses only Unicode UTF-8 text, such as com.apple.TextEncoding. In one window, open a text file with that xattr type and the correct contents (or use the article here detailing that xattr type). Copy the xattr type, and paste it into the top text box of a window opened on the destination file.

Then in the lower text box of the file with the valid xattr, select the text between the quotation marks, e.g.
UTF-8;134217984
excluding the quotation marks. Copy that, and paste it into the lower text box of the destination window.

Then click on the Add xattr button, and that xattr will be added to the file.

I am working on a solution suitable for handling binary data, and supporting more conventional copy and paste, for a future version of xattred.