MacOS – What are all these extra hidden files (with hash digests) that I can only see when running “ls”

findermacosterminal

Since upgrading to Yosemite, there seems to be an extra class of hidden files that are 'more hidden'. They are visible when I run ls, but not in my Finder (even though regular hidden files are visible on my machine).

For example, I can see .DS_Store in Finder, but then when I run ls in my terminal I can see extra versions:

.DS_Store
._.DS_Store.4ohM2f
._.DS_Store.b03KXd
._.DS_Store.zFFTiN

I suspect they might be some kind of revision history being saved for Time Machine, but I haven't set up Time Machine on my computer.

What are they and how do I get rid of them?

Best Answer

I will offer one example involving files with the prefix ._.

I have two volumes named Steelhead2 and Shark3. The volume named Steelhead is hfs+ formatted and the volume named Shark3 is ExFAT formatted. Consider the file iprogram.txt which has extended attributes. I can display these attributes using the ls command as shown below. 

Steelhead:Steelhead2 davidanderson$ ls -l@ /Volumes/Steelhead2/iprogram.txt
-rw-r--r--@ 1 davidanderson  staff  22668 May 26 10:22 /Volumes/Steelhead2/iprogram.txt
    com.apple.FinderInfo       32 
    com.apple.TextEncoding     15

Using the Finder, I copy this file to an empty folder named dots on Shark3. Again using the ls command I get the following.

Steelhead:dots davidanderson$ ls -la@ /Volumes/Shark3/dots
total 1024
drwxrwxrwx  1 davidanderson  staff  131072 Jun  8 10:46 .
drwxrwxrwx  1 davidanderson  staff  131072 Dec 31  1979 ..
-rwxrwxrwx  1 davidanderson  staff    4096 Jun  8 10:47 ._iprogram.txt
-rwxrwxrwx@ 1 davidanderson  staff   22668 May 26 10:22 iprogram.txt
    com.apple.FinderInfo        32 
    com.apple.TextEncoding      15

Partitions formatted ExFat can not have extended attributes. So OS X created the file ._iprogram.txt to contain these attributes. Next, I create a new folder named dots on Steelhead2 and use the Finder to copy just iprogram.txt to this folder. Using ls, I get the following.

Steelhead:Steelhead2 davidanderson$ ls -la@ /Volumes/Steelhead2/dots
total 48
drwxr-xr-x   3 davidanderson  staff    102 Jun  8 11:12 .
drwxrwxr-x  26 davidanderson  staff    952 Jun  8 11:11 ..
-rwxrwxrwx@  1 davidanderson  staff  22668 May 26 10:22 iprogram.txt
    com.apple.FinderInfo       32 
    com.apple.TextEncoding     15

Since Steelhead2 is hfs+ formatted, there is no need for a ._iprogram.txt file. Finally, returning to the folder /Volumes/Shark3/dots, I will remove the file ._iprogram.txt and enter the 'ls' command, as shown below.

Steelhead:dots davidanderson$ rm /Volumes/Shark3/dots/._iprogram.txt
Steelhead:dots davidanderson$ ls -la@ /Volumes/Shark3/dots
total 768
drwxrwxrwx  1 davidanderson  staff  131072 Jun  8 10:46 .
drwxrwxrwx  1 davidanderson  staff  131072 Dec 31  1979 ..
-rwxrwxrwx  1 davidanderson  staff   22668 May 26 10:22 iprogram.txt

The extended attributes are gone.

You are correct, these ._ prefixed files are hidden in the Finder. Even if you use defaults write com.apple.finder AppleShowAllFiles TRUE, these files remain hidden.

If you find ._ files in your hfs+ formatted partitions, some operation did not get synchronized property. Try using the command dot_clean to remove these '._' files. For more information either enter man dot_clean or see dot_clean -- Merge ._* files with corresponding native files.

Related Question