I searched google and found a list of hidden directories and files in OS X at http://www.westwind.com/reference/OS-X/invisibles.html but .file wasn't listed. The file is 0 size and looks like this

----------   1 root  admin        0 Aug 24  2013 .file

very suspicious?

Running McAfee virus scan there were over 700 additional files that were Not Scanned because they were protected.

  • /private/var
  • /private/etc
  • /Library/Caches
  • /Library/Application Support and others
  • I have .file as well, dating January 31st. May be just a leftover from an installer.
    – nohillside
    Commented Mar 18, 2016 at 14:24
  • Do not spend money on useless anti virus hoaxware.
    – bot47
    Commented Mar 18, 2016 at 16:38
  • I have .file as well on my Mac (running El Capitan) and my 2 jailbroken devices running iOS 6.1 and iOS 9.
    – Spotlight
    Commented Mar 18, 2016 at 22:32
  • 1
    Side question: is it possible for an empty file to be malicious?
    – wchargin
    Commented Mar 18, 2016 at 23:17

3 Answers 3


You can query the package receipt database.

pkgutil --file-info /.file

on a machine running OS X 10.6 the results are

volume: /
path: /.file

pkgid: com.apple.pkg.BaseSystem
install-time: 1252683091
uid: 0
gid: 80
mode: 0

pkgid: com.apple.pkg.Essentials
install-time: 1252683099
uid: 0
gid: 80
mode: 0
  • FWIW, in the current release of MacOS (Ventura), all I got were volume and path using both sudo pkginfo and pkginfo. Commented Feb 1, 2023 at 16:34

Yes, it's normal (and, as others have said, part of the standard OS installation).
It facilitates a natty Apple feature whereby files can be referenced by a composite key of device ID and inode ID, like this: /.file/id=6571367.17424234/
Every file and folder in your filesystem can be accessed via this alternate path.
One benefit of this 'reference' path is that it will not change when you rename a file (because the inode ID doesn't change when you rename a file). I think it's a fundamental part of how aliasing works on a Mac.

Don't remove it.

See 'file reference URL' in this Apple document.


Yes it's normal and the .file file is part of the BaseSystemResources.pkg and Essentials.pkg packages within the InstallESD.dmg disk image of the Install OS X $version.app bundle, e.g. Install OS X Mountain Lion.app, however I do not know its purpose.

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .