1

For some reason a directory I had (Vundle.vim) got randomly copied to another directory (got copied from ~/.vim to ~/dotfiles/.vim with strange permissions and what looks like no contents. Anyways, when I ran

ls -l Vundle.vim

I got

drw-r--r--@ 11 root  staff  374 Aug 14 20:22 Vundle.vim

and when I ran

xattr -l Vundle.vim/

this is what I got

xattr -l Vundle.vim/
com.apple.backupdelta.creationMarker: yes
com.apple.metadata:_kTimeMachineNewestSnapshot:
00000000  62 70 6C 69 73 74 30 30 33 41 BB 7E B4 DA 00 00  |bplist003A.~....|
00000010  00 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00  |................|
00000020  00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 11                                            |..|
00000032
com.apple.metadata:_kTimeMachineOldestSnapshot:
00000000  62 70 6C 69 73 74 30 30 33 41 BB 7E 82 12 00 00  |bplist003A.~....|
00000010  00 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00  |................|
00000020  00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 11                                            |..|
00000032
inodeForCreationOriginal: 10315546

Can anybody tell me what this output means or where I can find that information (some sort of documentation)?

2
  • Each extended attribute is a name-value pair. The middle two attributes values are stored in binary xml format. It seems quite obvious that all these attributes are Time Machine related.
    – fd0
    Aug 15, 2015 at 18:21
  • @fd0's comment is as close as you're likely to get to an answer. There are two issues I think: One is that Apple's file system is proprietary; Two is that Apple's documentation is not very good - non-existent in some cases. Apple uses xattr extensively - a lot of data is stored for purposes that can only be guessed.
    – Seamus
    Jul 30, 2022 at 0:11

1 Answer 1

2

To understand the output of xattr you'll first need to know that files on macOS consist of both their main payload (what you probably think of as the file) as well as ordinary metadata (which you're probably familiar with already, such as creation and modification time stamps, owner and group, permissions, etc.) -- and additionally can have so called "extended attributes".

"Extended attributes" are really just any data that someone might want to store alongside the file. Each extended attribute has a name and associated data. The name is typically stored in reverse domain name notation, such as for example "com.apple.backupdelta.creationMarker" that you got. The value can be really any value - text, number, binary, etc.

There's no central place where all these extended attributes are documented, as anyone really could think up of any attribute at any time and create it. The names do not have to be pre-approved by Apple or anything like that.

The attributes you have found on your file are markers left behind by Apple's Time Machine software. It is perfectly normal and not the indication of any type of problem, bug, or nefarious activity.

Two of the attributes have binary values. You'll see that the values begin with "bplist", which means that it is a binary property list. Those are typically used all across macOS to store all sorts of data, configuration, etc. In this case the data contain just a date and time.

As far as I know, com.apple.metadata:_kTimeMachineOldestSnapshot and com.apple.metadata:_kTimeMachineNewestSnapshot were used in older versions of Apple's Time Machine backup software to keep track of the oldest/newest snapshot (i.e. backup) that this particular file is a part of. It is included now only for backwards compatibility, and not actually used for tracking inclusion in snapshots.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .