hoakley Macs, Technology

What are all those hidden folders then?

If you press the Command, Shift, and Period/Stop keys in the Finder, you’ll see plenty of files and folders which are normally hidden from view. This article is a quick introduction to the most frequently-encountered hidden items, at the root level of volumes, and at the top level of your Home folder.

Different versions of macOS use different files and folders, and those from older versions may be migrated over to new systems. Some third-party apps and tools also create their own hidden files and folders, particularly at the top level of your Home folder.

Root level of a volume, including the boot volume – folders

  • .DS_Store – custom attributes of the containing folder, such as icon positions, can be found in any folder
  • .DocumentRevisions-V100/ ⛔️ – the macOS versioning database, detailed here.
  • .fseventsd/ ⛔️ – macOS FSEvents records, which record changes to the file system and are used by Time Machine to determine what to back up. Stored individually on each mounted volume.
  • .PKInstallSandboxManager/ – used for software updates and the Sandbox
  • .PKInstallSandboxManager-SystemSoftware/ 🔑 – used for system software updates
  • .Spotlight-V100/ ⛔️ – Spotlight metadata, stored individually on each mounted volume. These are compiled by mdworker processes, and are used by Spotlight search, other macOS-based search features, and Time Machine.
  • .TemporaryItems/ ⬇️ – for temporary items
  • .Trashes/ ⬇️ – Trash folder, stored individually on each mounted volume.
  • .vol/ – a pseudo-directory used to access files by their ID or inode number.
  • bin/ 🔑 – core command tools
  • cores/ – core files
  • dev/ – Unix-style devices
  • etc/ 🔑 ➡️ – configuration files and settings
  • home/
  • net/
  • opt/ – optional installations such as X11
  • private/ – where /etc, /tftpboot, /tmp and /var actually are
  • sbin/ 🔑 – system command tools
  • tmp/ 🔑 ➡️ – temporary files and caches, which can be written by any user
  • usr/ 🔑 – user command tools and a lot more too
  • var/ 🔑 ➡️ – miscellaneous data and configuration files
  • Volumes/ – all mounted volumes, including the boot volume
  • AppleInternal/ – used only in Apple’s in-house builds, which you should never see.

Root level of a volume, including the boot volume – files

  • .com.apple.timemachine.supported – marks that this folder is supported as a target for Time Machine backups.
  • .file – facilitates access to files by their ID or inode number.
  • .OSInstallerMessages – messages written by macOS installers.
  • .VolumeIcon.icns – custom icons to be used to show a volume in the Finder.
  • installer.failurerequests – written by macOS installers, even after a successful installation.
  • tmbootpicker.efi – marks a bootable Time Machine backup volume, enabling it to be used for recovery.

Top level of your Home folder (~/)

  • .bash_history – command history of the bash shell in Terminal.
  • .bash_profile – profile settings of the bash shell in Terminal.
  • .bash_sessions/ – folder containing individual bash shell sessions.
  • .cups/ – CUPS printing files
  • .ssh/ – contains known_hosts, listing known SSH hosts.
  • Library/ – the Home folder library, ~/Library, containing settings, etc.

Symbols used:
🔑 = protected by SIP
⛔️ = permissions locked down, root access only
⬇️ = drop box, write only
➡️ = symbolic link to folder in /private.