An introduction to extended attributes, xattrs
APFS: Extended attributes revisited
iCloud Drive changes extended attributes
How to save file metadata in iCloud, and new info on extended attributes
How to save your file metadata – implementation isn’t simple
How do the Finder, Terminal and Spotlight handle extended attribute flags?
There’s something wrong with that file: could it be a xattr issue?
Where did that metadata come from?
How macOS tracks your files: inside the inode
Can macOS tell how large a file really is?
How to check that a file really is a faithful copy
How to preserve metadata stored in a custom extended attribute
Opening documents, SIP and quarantine flags in Catalina

General

Documenting the hidden – xattr documentation project
Extended attributes: surprisingly common, and information-rich
Sandboxing makes quarantine flags almost meaningless
Where are all those extended attributes?
How big is that file? How Finder and Terminal file sizes can mislead
Extended attributes in High Sierra 10.13.2
Show me your metadata: extended attributes in macOS Sierra
Which file systems and Cloud services preserve extended attributes?
iCloud Drive has user modes, and tags transferred apps
How iCloud marks the place of documents stored remotely
Off to a good start, then – iCloud filtering xattrs, and more
iCloud Drive can strip (meta)data from your documents
macOS code signing and Gatekeeper ignore extended attributes
Quarantined: more about the quarantine extended attribute
Finder Info: how Sierra and High Sierra remember Classic Mac OS
Inside Finder Tags
A short trip with rootless: what you can and cannot do
Improving Spotlight search: SearchKey and SearchKeyLite 1 released
Search Perfect: hitting it off with SearchKey 1.0b1 – and using xattrs in search
Spotlight: using metadata to improve local searches
File types, the UTI, and even more metadata
Hazel and SearchKeyLite bring order to your documents
Clipping files: copying through the Finder
Why all those quarantine flags?
🎗 Quarantine: Apps
🎗 Quarantine: Documents
Quarantine, SIP, and MACL: macOS per-file security controls

Coding

Easy access to xattrs from Swift 4: Martin R’s URL extension
More Fun Scripting with Swift in Xcode: extended attributes
Beyond Scripting in Swift: Direct access to xattrs, calling C, and converting Data to Strings
Beyond Scripting in Swift: When xattrs are not like files

Tools

Metadata editing made easy with Metamer version 1
xattred 1.1 (El Capitan, Sierra, High Sierra and Mojave)
Pratique 1.1 (Sierra, High Sierra, Mojave and Catalina)
Sandstrip 1.1 (Sierra, High Sierra, Mojave and Catalina)
Scrub 1.0b2 (El Capitan, Sierra, High Sierra and Mojave)
SearchKey 1.3 (El Capitan, Sierra, High Sierra, Mojave and Catalina)
SearchKeyLite 1.3 (El Capitan, Sierra, High Sierra, Mojave and Catalina)
Precize 1.8 (El Capitan, Sierra, High Sierra and Mojave)
cmpxat 2 (El Capitan to Catalina) – compare xattrs command tool

xattr database

Format and conventions

com.apple.cscachefs, iCloud Drive app tag
com.apple.diskimages.fsck, record of disk image integrity check
com.apple.diskimages.recentcksum, disk image checksum
com.apple.FinderInfo, information for the Finder
com.apple.icloud.itemName, iCloud Drive placeholder filename
com.apple.LaunchServices.OpenWith, sets a custom app to open a file
com.apple.logd.metadata, log metadata
com.apple.metadata:com_apple_backup_excludeItem, exclude from backups
com.apple.metadata:kMDItemCopyright, records copyright info
com.apple.metadata:kMDItemCreator, records the app which created a file
com.apple.metadata:kMDItemDescription, arbitrary information about a file
com.apple.metadata:kMDItemDownloadedDate, the download datestamp
com.apple.metadata:kMDItemHeadline, an arbitrary text headline
com.apple.metadata:kMDItemWhereFroms, origin of downloaded file
com.apple.metadata:_kMDItemUserTags, Finder tags
com.apple.metadata:_kTimeMachineNewestSnapshot, old backup details
com.apple.metadata:_kTimeMachineOldestSnapshot, old backup details
com.apple.quarantine, the quarantine flag
com.apple.ResourceFork, a classic Mac resource fork
com.apple.rootless, protects with SIP
com.apple.TextEncoding, reveals text file encoding
com.apple.uuiddb.boot-uuid, log metadata
lock, a log file lock
org.openmetainfo: and org.openmetainfo.time: families, third-party metadata