Extended attributes (xattrs)

An introduction to extended attributes, xattrs
There’s something wrong with that file: could it be a xattr issue?
Where did that metadata come from?
How macOS tracks your files: inside the inode
Can macOS tell how large a file really is?


Documenting the hidden – xattr documentation project
Extended attributes: surprisingly common, and information-rich
Where are all those extended attributes?
How big is that file? How Finder and Terminal file sizes can mislead
Extended attributes in High Sierra 10.13.2
Show me your metadata: extended attributes in macOS Sierra
Which file systems and Cloud services preserve extended attributes?
iCloud Drive has user modes, and tags transferred apps
How iCloud marks the place of documents stored remotely
Off to a good start, then – iCloud filtering xattrs, and more
iCloud Drive can strip (meta)data from your documents
macOS code signing and Gatekeeper ignore extended attributes
Quarantined: more about the quarantine extended attribute
Finder Info: how Sierra and High Sierra remember Classic Mac OS
Inside Finder Tags
A short trip with rootless: what you can and cannot do
Search Perfect: hitting it off with SearchKey 1.0b1 – and using xattrs in search
Spotlight: using metadata to improve local searches
File types, the UTI, and even more metadata
Hazel and SearchKeyLite bring order to your documents


Easy access to xattrs from Swift 4: Martin R’s URL extension
More Fun Scripting with Swift in Xcode: extended attributes
Beyond Scripting in Swift: Direct access to xattrs, calling C, and converting Data to Strings
Beyond Scripting in Swift: When xattrs are not like files


xattred 1.0b4 (El Capitan, Sierra and High Sierra)
SearchKey 1.0b1 (El Capitan, Sierra and High Sierra)
SearchKeyLite 1.0b9 (El Capitan, Sierra and High Sierra)
Precize 1.0b2 (El Capitan, Sierra and High Sierra)

xattr database

Format and conventions

com.apple.cscachefs, iCloud Drive app tag
com.apple.diskimages.fsck, record of disk image integrity check
com.apple.diskimages.recentcksum, disk image checksum
com.apple.FinderInfo, information for the Finder
com.apple.icloud.itemName, iCloud Drive placeholder filename
com.apple.LaunchServices.OpenWith, sets a custom app to open a file
com.apple.logd.metadata, log metadata
com.apple.metadata:com_apple_backup_excludeItem, exclude from backups
com.apple.metadata:kMDItemCopyright, records copyright info
com.apple.metadata:kMDItemCreator, records the app which created a file
com.apple.metadata:kMDItemDescription, arbitrary information about a file
com.apple.metadata:kMDItemDownloadedDate, the download datestamp
com.apple.metadata:kMDItemHeadline, an arbitrary text headline
com.apple.metadata:kMDItemWhereFroms, origin of downloaded file
com.apple.metadata:_kMDItemUserTags, Finder tags
com.apple.metadata:_kTimeMachineNewestSnapshot, old backup details
com.apple.metadata:_kTimeMachineOldestSnapshot, old backup details
com.apple.quarantine, the quarantine flag
com.apple.ResourceFork, a classic Mac resource fork
com.apple.rootless, protects with SIP
com.apple.TextEncoding, reveals text file encoding
com.apple.uuiddb.boot-uuid, log metadata
lock, a log file lock
org.openmetainfo: and org.openmetainfo.time: families, third-party metadata