Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am saving some files because I need to reinstall OS X, and noticed oddly high numbers of files in some folders. Is it possible for malware to hide files from ls?

share|improve this question
up vote 3 down vote accepted

Hidden files are hidden from ls unless you use the -a or -A flag:

-A   List all entries except for . and ...  Always set for the super-user.
-a   Include directory entries whose names begin with a dot (.).

Source: ls man page

Therefore, files can be hidden by starting the filename with a . but ls will still show the file if it is run with -a or -A.

Note that not all files that are hidden with a . are malware-related. The system creates many files like this for a variety of reasons in various places on the disk that can cause problems if removed or modified.

share|improve this answer
one additional note: there are many legitimate files the OS hides in this manner. Finding files using ls -a does not indicate the presence of malware. – dwightk Apr 10 '14 at 12:56
@dwightk I know, but maybe other people reading this don't. (grgarside: maybe include it in the answer, as some people - including me - do not always read all the comments.) – 11684 Apr 10 '14 at 14:29

ls is not a command that opens the directory file itself and show it's contents. It uses dirent (Directory Entries) from the C library which is used by a lot of software like stat but also bash's parameter expansion.

So the real question is then: Is it possible for malware to hide files from BSD/Darwin? No, you can't hide files from it's own system because it will turn into waste (read:free to overwrite) very soon.

share|improve this answer
Thank you, this was very helpful as well. (Hence +1.) – 11684 Apr 10 '14 at 14:30
What is this command "Ls"? :) – Almo Apr 10 '14 at 14:45
It list all the directories and files in the current directory. (Including hidden files if you add the -a flag.) For more information, click on the man page link in grgarside's answer. – 11684 Apr 10 '14 at 17:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.