1

My User's Application folder does not contain the regular Applications' folders one might expect. Instead it contains an index.dat file and a lot of sub-folders that are serially numbered (00,01,...,0f,...,9f,...,a0,...,af,...,ff) and contain *.file files like "00b1bfebc0ceb054d7872956649e40b091ab9341.file".

See following screenshot:


File Structure


I'm cleaning up my mac and am not sure if I can delete this. I don't know which Application is creating this... filesystem?.

Some files are written even today so, is there a way to find out which Application is writing these files?


Update:

I did the following:

  1. Deleted the files and folders in question
  2. Restart Machine
  3. Log user back in
  4. Quickly open terminal and run sudo fs_usage | grep index.dat
  5. See the file being accessed by the following:
13:10:44  open              /Users/lapdog/Applications/index.dat                                             0.000041   mdworker    
13:10:44  getattrlist       /Users/lapdog/Applications/index.dat                                             0.000027   mds         
13:11:23  lstat64           Users/lapdog/Applications/index.dat                                              0.000022   fseventsd   
13:11:23  getxattr          /Users/lapdog/Applications/index.dat                                             0.000011   Dock        
13:11:23  lstat64           /Users/lapdog/Applications/index.dat                                             0.000023   fseventsd   
13:11:24  fsgetpath         /Users/lapdog/Applications/index.dat                                             0.000021   mds         
13:11:24  getattrlist       /Users/lapdog/Applications/index.dat                                             0.000046   mds         
13:11:24  listxattr         /Users/lapdog/Applications/index.dat                                             0.000020   mds         
13:11:24  getattrlist       /Users/lapdog/Applications/index.dat                                             0.000081   mds

and a lot more of that until it stops. I still don't know if this is being created upon login or restart. I will check with a different user if the files are being created b4 logging in the with my user again.

  • These would appear to be internet browsing history files as recorded by Windows. If you don’t have Bootcamp or Parallels installed, it is mysterious. Go ahead and delete them and see what happens. If they continue to be created, report back. – IconDaemon Jul 26 at 12:23
  • I deleted it. I also deleted Parallels, which was still in my applications from an old installation. But the image Parallels would have tried to start was gone, so it is strage that is continued to create those files. Anyway, at the moment none of the sub-folders or files have been createt again. Thanks! I will report back if they reappear – Aerials Jul 26 at 13:21
  • The folders are back – Aerials Jul 26 at 21:38
1

Like all things, backup your Mac and then delete the files you suspect are bad / need to know when they re-appear. Backups exist so you are free to clear things knowing you can get them back if you find out later some specific program actually needs them where they are.

Examining the files like this you have some clues that often will let you refine what caused them to be there:

  1. What permissions / ownership is on the files?
  2. What are the created dates, last modified dates?
  3. Can you catch it with lsof or fs_usage (both of which are covered here on site pretty well on how to check for what process has a file open and which process reads / modifies / writes to a file)
  4. Open terminal and use the file command to actually inspect the contents. Open them in an editor or a great free program like BBEdit to look at them safely. (Type file and a space and then drag one or two of the curious file icons into the terminal window and press return)

What’s clear, is it’s not a program that behaves at all like a mac program and puts application files where they belong in user or system libraries. I would focus on things that are cross-platform or open-source as that’s a typical pattern to shard data to directories that are named algorithmically (Apple does this in /private/var/folders) as well - but hides that away from where people expect properly curated files to exist.

| improve this answer | |
  • These are good suggestions, thank you! The folders reappeared though . The files are owned by my user. Last created a few minutes ago (I think upon reboot). It appears to be constantly creating files because the times of creation are minutes appart. file returns magic file from /usr/share/file/magic – Aerials Jul 26 at 21:42
  • 1
    @Aerials Excellent! Are you comfortable using terminal? sudo fs_usage | grep index.dat might reveal what’s accessing or creating that file. – bmike Jul 26 at 21:45
  • I am comfortable with the terminal. But running sudo fs_usage | grep index.dat isn't helping much, because it seems these files where created at startup, and are not being accessed anymore. Can I somehow use fs_usage on boot? – Aerials Jul 27 at 8:02
  • Not easily. Safe boot and then start looking at your launch agents and daemons is next. Great that you know when they arrive, now. – bmike Jul 27 at 11:01
  • I updated my question. How would I go about looking into my "launch agents & deamons"? Thanks! – Aerials Jul 27 at 11:18
1

You asked about tools to explore persistently installed apps. Some tools include:

KnockKnock: https://objective-see.com/products/knockknock.html

Launch Control: https://www.soma-zone.com/LaunchControl/

| improve this answer | |
  • You might also try inspecting the index.dat file in an editor for hints, as well as the files in the indice directories (as suggested by @bmike as I see now). – newyork10023 Jul 27 at 12:09
0

Ok, I figured it out. Thanks @bmike & @IconDaemon

The culprit is Spotify's desktop client, which has a setting to store offline music. (And doesn't create a containing folder to identify it)

I had the preference option to store offline music in my ~/Applications folder. And also had set up Spotify to open upon login. (See screenshot)

previous preferences

Solution:

Change the offline songs storage location to a different folder. I created a new folder to do so and the files moved immediately.

Note:

Create a folder with a easily identifiable name for offline song storage! (eg. "Spotify Offline Music").

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .