Extended attributes (xattrs)

An introduction to extended attributes, xattrs
There’s something wrong with that file: could it be a xattr issue?
Where did that metadata come from?


Documenting the hidden – xattr documentation project
Extended attributes: surprisingly common, and information-rich
Extended attributes in High Sierra 10.13.2
Show me your metadata: extended attributes in macOS Sierra
Which file systems and Cloud services preserve extended attributes?
Off to a good start, then – iCloud filtering xattrs, and more
iCloud Drive can strip (meta)data from your documents
Quarantined: more about the quarantine extended attribute
Finder Info: how Sierra and High Sierra remember Classic Mac OS
Inside Finder Tags
A short trip with rootless: what you can and cannot do
Spotlight: using metadata to improve local searches


Easy access to xattrs from Swift 4: Martin R’s URL extension
More Fun Scripting with Swift in Xcode: extended attributes
Beyond Scripting in Swift: Direct access to xattrs, calling C, and converting Data to Strings
Beyond Scripting in Swift: When xattrs are not like files


xattred 1.0b2 (El Capitan, Sierra and High Sierra)
SearchKey 0.2a1 (El Capitan, Sierra and High Sierra)

xattr database

Format and conventions

com.apple.FinderInfo, information for the Finder
com.apple.LaunchServices.OpenWith, sets a custom app to open a file
com.apple.logd.metadata, log metadata
com.apple.metadata:com_apple_backup_excludeItem, exclude from backups
com.apple.metadata:kMDItemCopyright, records copyright info
com.apple.metadata:kMDItemCreator, records the app which created a file
com.apple.metadata:kMDItemDescription, arbitrary information about a file
com.apple.metadata:kMDItemDownloadedDate, the download datestamp
com.apple.metadata:kMDItemHeadline, an arbitrary text headline
com.apple.metadata:kMDItemWhereFroms, origin of downloaded file
com.apple.metadata:_kMDItemUserTags, Finder tags
com.apple.metadata:_kTimeMachineNewestSnapshot, old backup details
com.apple.metadata:_kTimeMachineOldestSnapshot, old backup details
com.apple.quarantine, the quarantine flag
com.apple.ResourceFork, a classic Mac resource fork
com.apple.rootless, protects with SIP
com.apple.TextEncoding, reveals text file encoding
com.apple.uuiddb.boot-uuid, log metadata
lock, a log file lock