I searched google and found a list of hidden directories and files in OS X at http://www.westwind.com/reference/OS-X/invisibles.html but .file wasn't listed. The file is 0 size and looks like this

----------   1 root  admin        0 Aug 24  2013 .file

very suspicious?

Running McAfee virus scan there were over 700 additional files that were Not Scanned because they were protected.

  • /private/var
  • /private/etc
  • /Library/Caches
  • /Library/Application Support and others
  • I have .file as well, dating January 31st. May be just a leftover from an installer. – nohillside Mar 18 '16 at 14:24
  • Do not spend money on useless anti virus hoaxware. – bot47 Mar 18 '16 at 16:38
  • I have .file as well on my Mac (running El Capitan) and my 2 jailbroken devices running iOS 6.1 and iOS 9. – Spotlight Mar 18 '16 at 22:32
  • Side question: is it possible for an empty file to be malicious? – wchargin Mar 18 '16 at 23:17

You can query the package receipt database.

pkgutil --file-info /.file

on a machine running OS X 10.6 the results are

volume: /
path: /.file

pkgid: com.apple.pkg.BaseSystem
install-time: 1252683091
uid: 0
gid: 80
mode: 0

pkgid: com.apple.pkg.Essentials
install-time: 1252683099
uid: 0
gid: 80
mode: 0
| improve this answer | |

Yes it's normal and the .file file is part of the BaseSystemResources.pkg and Essentials.pkg packages within the InstallESD.dmg disk image of the Install OS X $version.app bundle, e.g. Install OS X Mountain Lion.app, however I do not know its purpose.

enter image description here

| improve this answer | |

Yes, it's normal (and, as others have said, part of the standard OS installation).
It facilitates a natty Apple feature whereby files can be referenced by a composite key of device ID and inode ID, like this: /.file/id=6571367.17424234/
Every file and folder in your filesystem can be accessed via this alternate path.
One benefit of this 'reference' path is that it will not change when you rename a file (because the inode ID doesn't change when you rename a file). I think it's a fundamental part of how aliasing works on a Mac.

Don't remove it.

See 'file reference URL' in this Apple document.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .