- [Instructor] As we've seen,
Macs have a pretty extensive set of file system metadata.
If we keep our work confined to Macs and Mac format discs,
we shouldn't have any issues
with this metadata for our files.
But when we exchange discs and files with other platforms,
we may start to see some behavior that seems odd at first.
When working with files between a Mac and other platforms,
we'll sometimes see files with names similar to our files
but would start with dot underscore.
These are called AppleDouble files
and they're how a Mac stores extended attributes
and other information for files
on a file system that doesn't support
storing all of the Apple metadata.
Most notably,
we'll find these files on some non-Mac file systems
and network file shares
depending on how they're configured.
Modern file sharing servers using SMB
can store the metadata for files in an alternate data stream
if they're configured to do so.
However, portable discs using non-Mac file systems
usually don't have support for this extended Mac metadata.
One notable example here is the popular exFAT file system,
which is useful for transferring files
between all three major platforms.
And so is often used for SD cards, flash drives,
and other similar media.
Because non-Mac file systems
often don't support the extended attributes
like highlight color and flags and so on,
a Mac will try to help us out
by preserving those values in AppleDouble files
rather than simply throwing them away,
when we copy from our Mac to a non-Mac disc.
Here, for example,
I have an exFAT drive
and on my Mac I have a file with all sorts of metadata
attached to it.
It has a comment and it's highlighted blue.
I'll copy this file from my Mac to the exFAT drive.
And, well, that looks normal.
What's happened here though,
is that MacOS has created an AppleDouble file
holding the extended metadata
and the Mac Finder knows about that trick.
So we don't see the AppleDouble file
but we see its effect.
We won't even see that AppleDouble file
if we turn on show hidden files with command+shift+.
though we can see other hidden items.
Over here in my terminal, I'll browse to that disc
and I'll list all the files.
This here is the AppleDouble file
that my Mac created for the file I copied over.
We can see these files in the terminal
and we'll be able to see them on other platforms too.
As an aside, notice also that the permission string
for these files on this disc are all completely open.
exFAT doesn't support basic permissions at all,
so this is how the Mac represents that.
While this AppleDouble file
represents MacOS trying to preserve metadata
that the user might find helpful,
to users of other platforms we might be interacting with,
these files can end up looking to them like digital glitter
scattered around by MacOS for no reason.
But remember,
if there's an AppleDouble file alongside a regular file,
it means that there's at least
some piece of extended metadata for that file
that a Mac was trying to preserve
instead of just throwing it away.
Maybe it's useful to us and maybe it isn't.
The Mac doesn't know, so it's trying to be helpful.
Because these files represent some metadata attached to,
well, formally attached to files,
they can present a security risk.
Even though other platforms can't really use the files
in a meaningful way like Finder does,
they can still read the files
and perhaps discover some information
we didn't intend to share.
I'll write xxd
and then use the file name for the AppleDouble file.
Here for example,
we can see that this file is highlighted blue
in this binary P-List structure.
And we can read the comment
that had been attached to the file.
Remember that on this file system,
this is a completely separate file from the original.
If we were to delete this AppleDouble file
from a disc we might use on a Mac,
the Mac won't have that metadata anymore,
but the original file will remain.
So our highlights and our tags and so on
would simply be gone.
On the other hand,
if we were to delete the original file
from a different platform like Windows or Linux,
that operating system
wouldn't know to also delete this AppleDouble file.
So the AppleDouble file would be left behind
and could possibly reveal not only the name,
but also some metadata about the deleted file.
If we're working on a shared disc
with files that we don't need metadata for,
we can delete these files manually.
Apple provides a utility called dot_clean
that can be useful in cleaning these up.
If the AppleDouble files and their associated files
are stored on a disc that does have support
for extended attributes, for example,
if they had initially been stored on a disc
that didn't support metadata
and were then later moved to somewhere that does,
dot_clean-m will attempt to reintegrate the data
from the AppleDouble files and delete the AppleDouble files.
This scenario is fairly narrow but can be useful.
If we run dot_clean-m
on a disc that doesn't have metadata support though,
it will simply delete the files
discarding the extra metadata
because there's nowhere for it to be stored.
If you're working with Macs,
you might notice other similar files and directories,
especially with file sharing over AFP or SMB.
Sometimes we'll see a .appleDB directory
on a disc shared through AFP,
but whose file system
doesn't support the Apple file system metadata.
And we might see a .AppleDouble directory as well
in other scenarios.
These are all attempts to store file system metadata
on file systems that don't natively support it.
Usually these are best left alone because as we've seen,
there's strategies for storing metadata
that could be important,
but because they're all files,
they can get caught up in file operations
or otherwise add unwanted items to shared file systems.