enter image description here

Library/Privileged Helper Tools is empty. Library/PrivilegedHelperTools has 3 items belonging to known installed applications within it.

  • What version of Mac OS X is running? What's the Date Modified for the "Privileged Helper Tools" folder? In Terminal you can look at the folder & visible/invisible contents with ownerships using: ls -laf /Library/PrivilegedHelperTools/. The folder without the spaces seems to be the default on the three Macs I personally manage. – IconDaemon Feb 13 '16 at 15:05
  • Yeah, even with invisible files toggled, it is still empty -- at least, right now. The creation date is December 11, 2015 as is the modification date by a difference of about ten minutes. I'm running the most recent publicrelease El Capitan. – Kerlix Feb 13 '16 at 18:08
  • I'd just delete it then. – IconDaemon Feb 13 '16 at 20:40

No, you should only have “PrivilegedHelperTools” without the spaces. Make sure the folder with spaces really is empty including hidden files, then it should be safe to delete.

  • Is there any kind of forensics I could run to see what is or was making use of this folder? What created it? – Kerlix Feb 13 '16 at 18:08

fseventer (compatible until OS X 10.9.x) shows you all files which get read/written at the moment and it also has filters. So by creating the filter [path ▼] [includes ▼] "/Library/Privileged Helper Tools" and running fseventer for some time, this may reveal which process considers this folder and its contents. But nevertheless with this method you won't find out if the suspicious folder is used during booting and shutdown.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .