Type: com.apple.diskimages.recentcksum
Subtypes: none
Serialisation: none
Data type: UTF-8 text containing an integer, UUID, time, and a full checksum result.
Example: <693a3432 39373930 31363332 206f6e20 46454633 44393444 2d424245 322d3341 43462d38 3741362d 46344436 30303237 42333938 20402031 35313236 30323436 35202d20 43524333 323a2437 39353531 384535> «i:4297901632 on FEF3D94D-BBE2-3ACF-87A6-F4D60027B398 @ 1512602465 – CRC32:$795518E5»
macOS: Sierra, High Sierra
System use: none
App use: only if an app includes a disk image (rare)
Document use: only in stored disk images (rare)
Other usage: found in all read-only or compressed disk images which have been mounted previously.

Purpose: contains details of the last checksum of the disk image using hdiutil
Information:
When a read-only or compressed disk image is mounted, its checksum is normally computed and checked against that expected, using hdiutil verify. This xattr contains a record of the most recent check performed, including the UUID of that event, the type of checksum calculated (usually CRC32), and the result in hexadecimal. This can be compared against the checksum stored in the image for verification. Read/write disk images don’t contain checksums, so cannot be verified in this way.

The content follows a standard format:
i:[decimal integer] on [UUID of event] @ [decimal integer system time] - CRC32:$[hex checksum]

Presumably other types of checksum can also be used, as documented in man hdiutil.

Tools: xattred, xattr

Links:

Original page: 2018-02-04
Last modified: 2018-02-04