I am saving some files because I need to reinstall OS X, and noticed oddly high numbers of files in some folders. Is it possible for malware to hide files from
Hidden files are hidden from ls unless you use the
Source: ls man page
Therefore, files can be hidden by starting the filename with a
Note that not all files that are hidden with a . are malware-related. The system creates many files like this for a variety of reasons in various places on the disk that can cause problems if removed or modified.
ls is not a command that opens the directory file itself and show it's contents. It uses dirent (Directory Entries) from the C library which is used by a lot of software like stat but also bash's parameter expansion.
So the real question is then: Is it possible for malware to hide files from BSD/Darwin? No, you can't hide files from it's own system because it will turn into waste (read:free to overwrite) very soon.