4

I just noticed that I've got a mysterious file simply called ~ in the root of my harddrive. I suspect that I've created it by accident while using terminal.

I know about using ~ as an alias to quickly get to the current user and I use it extensively, so there is a reasonable chance that I've been wanting to create a new file and possibly been in the process of writing something in the lines of touch ~/new_filebut changed my mind and accidentally pressed enter after touch ~?

But that does not explain the fact that the file is 3.1MB?

Furthermore, the file appears as a file in Finder, but if I try doing either cat ~ or vim ~on it in terminal I'm told that it is actually a directory. But doing an ls -l suggests something else:

-rw-------    1 root  wheel   3.0M Apr  3 13:37 ~

And have a look at the creation date ...today at 13:37 (ie. LEET).

I discovered that there are a couple of threads where people experience the same thing and the answer seems to be some application failing to write to the user directory, but the timestamp is what makes me suspicious (tin foil hat?).

  1. Could this be something malicious?
  2. Can I log what or who wrote the file somehow?
  3. Can I figure out what's inside it?
  4. How can I make sure it is safe to delete this file/directory or whatever it is?

Edit: Regarding this question being marked as a duplicate, I explicitly mention that I've read the original thread and none of my four questions above have been answered in that thread, so please read the entire question before flagging.

Improve this question
4
  • Thanks for the follow-up. I read that you mentioned that you'd seen ‘a couple of threads’ but in my opinion the one I linked to was basically identical in what was being asked. I'll write up an answer here with more detail regarding the specific questions that you're asking.
    – grg ♦
    Commented Apr 3, 2015 at 12:40
  • What version of OS X are you using? What Shell are you using? Have you tried using sudo, e.g., sudo cat /~?
    – user3439894
    Commented Apr 3, 2015 at 12:54
  • sudo does not change anything. I'm using oh-my-zsh as my shell and I'm running Yosemite (10.10.2).
    – zkwsk
    Commented Apr 3, 2015 at 13:06
  • I do not believe for one minute that the contents of the file cannot be looked at by one means or another nor would I just leave the file there and continue to let it be written to without knowing what's writing to it and there are ways to accomplish both.
    – user3439894
    Commented Apr 3, 2015 at 14:59

1 Answer 1

Reset to default
1
  1. Could this be something malicious?

No, this is simply a file on your computer that happens to be named the same as a shell expansion. It doesn't have the execute bit set, so can't be executed as a binary file by Terminal. A malicious app probably won't be creating a ~ file in the root of your hard disk.

  1. Can I log what or who wrote the file somehow?
  2. Can I figure out what's inside it?

You won't be able to find out what wrote the file unless it was a process which wrote to the console (/Applications/Utilities/Console.app). You can look for processes which are currently accessing the file with sudo opensnoop -f "/~".

Seeing which processes (if any) are accessing the file may give you an indication as to what is inside the file, or you can open it with a text editor or hex editor and certain phrases might be recognisable to you, which may give you an indication as to

  1. How can I make sure it is safe to delete this file/directory or whatever it is?

If opensnoop says that nothing's currently accessing it and nothing accesses it whilst you use your computer, then you're not breaking anything by removing it. It's not a file that should be there, or is required by the system to function.

For more information about this subject, see this related question:

Improve this answer
3
  • Thanks fr your reply. I tried running opesnoop, but I don't know how to interpret the output: gist.github.com/webconsult/7252e72fcdadb3e6c938 I did, however, discover that the file has been updated and the creation/modified date is now today at 14:33. I'm assuming I installed an app that tries to write to the wrong path and it just happened to have done so at 13:37 by coincidence. I am suspecting jDownloader.
    – zkwsk
    Commented Apr 3, 2015 at 13:11
  • @funkylaundry You can ignore all the dtrace errors. The only process shown in that snip was Finder, which is to be expected. I guess you could keep the opensnoop running for a bit (grep -v for dtrace/Finder if you wish to keep the output clean) and see if anything comes up.
    – grg ♦
    Commented Apr 3, 2015 at 13:22
  • Thanks, I'll try keeping an eye on it, but my biggest worry was the potential of someone doing something malicious due to the infamous creation date. The file has not grown radically but it has been updated since. I did not have opensnoop running though, but I'll see what happens next time something/someone writes to the file.
    – zkwsk
    Commented Apr 3, 2015 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .