hoakley xattr

xattr: com.apple.FinderInfo, information for the Finder

Type: com.apple.FinderInfo
Subtypes: none
Serialisation: none
Data type: binary, fixed length of 32 bytes, starting with 8 single-byte characters
Example: <4a504547 474b4f4e 00000000 00000000 00000000 00000000 00000000 00000000> «JPEGGKON »
macOS: El Capitan, Sierra, High Sierra
System use: very infrequent
App use: common
Document use: very common
Other usage: also in hidden files such as .DS_Store

Purpose: stores legacy ‘Finder Info’ and additional information for the Finder
Information:
Grew from the Classic Mac OS Finder information, which designates four-character codes for a file’s type and creator. The additional 24 bytes contain undocumented flags which are used by the Finder and other system features.

For example, an alias to a file is likely to have a xattr such as
<616c6973 4d414353 80000000 00000000 00000000 00000000 00000000 00000000>
«alisMACS »
which contains the classic type of alis to indicate it is an alias, and the creator MACS, which is the macOS system.

Most of the flags in the trailing 24 bytes are obscure. Two which are easily discoverable are:
<00000000 00000000 08000000 00000000 00000000 00000000 00000000 00000000> Stationery pad
<00000000 00000000 00100000 00000000 00000000 00000000 00000000 00000000> Hide extension

Single colour tags can also be stored here, instead of in the com.apple.metadata:_kMDItemUserTags xattr, but these only support standard Finder tags and colours. The single-byte kColor flag is just to the right of the Hide extension flag:
<00000000 00000000 00040000 00000000 00000000 00000000 00000000 00000000> sets the Green tag, for example.

Supported colour flag values are:

  • none = 0, 1
  • grey = 2, 3
  • green = 4, 5
  • purple = 6, 7
  • blue = 8, 9
  • yellow = A, B
  • red = C, D
  • orange = E, F.

These can be set easily from the command line, provided that no other Finder Info is stored for that item, using a command such as
xattr -wx com.apple.FinderInfo "0000000000000000000400000000000000000000000000000000000000000000" filename

Although sometimes suggested that Finder comments and complete tags are stored in this xattr, they are not, at least as of Sierra.

Tools: Finder (Get Info dialog, some settings), xattred, xattr

Links:

Original page: 2017-12-18
Last modified: 2017-12-30