xattr: com.apple.metadata:kMDItemCreator, records the app which created a file

Type: com.apple.metadata
Subtypes: kMDItemCreator
Serialisation: none
Data type: binary property list containing some UTF-8 text, as a single NSString.
Example: <62706c69 73743030 5f101047 72617068 6963436f 6e766572 74657208 00000000 00000101 00000000 00000001 00000000 00000000 00000000 0000001b> «bplist00_ GraphicConverter »
macOS: Sierra, High Sierra
System use: only found in /Library, and rare there
App use: rare
Document use: more common
Other usage: none

Purpose: contains the name of the app which ‘created’ the file
In addition to the name of the app, contains undocumented binary content which appear to be flags.

Tools: xattred, xattr


Original page: 2017-12-18
Last modified: 2017-12-30