0

I wanted to find what program created a dot file. I ran mdls /path/to/file on the file.

john@iMacEth ~ % mdls /Users/john/Library/Application\ Support/.lldb_info_3F4AF17D8C 
kMDItemFSContentChangeDate = 2023-08-14 21:14:13 +0000
kMDItemFSCreationDate      = 2023-08-14 21:14:13 +0000
kMDItemFSCreatorCode       = ""
kMDItemFSFinderFlags       = 0
kMDItemFSHasCustomIcon     = 0
kMDItemFSInvisible         = 1
kMDItemFSIsExtensionHidden = 0
kMDItemFSIsStationery      = 0
kMDItemFSLabel             = 0
kMDItemFSName              = ".lldb_info_3F4AF17D8C"
kMDItemFSNodeCount         = 181
kMDItemFSOwnerGroupID      = 20
kMDItemFSOwnerUserID       = 501
kMDItemFSSize              = 181
kMDItemFSTypeCode          = ""

In the past I've been able to find which program created it just looking at the modification date and cross referencing what programs where installed around that time.

I tried to find using

mdfind 'kMDItemFSCreationDate > $time.iso(2023-08-14 21:14:00) &&  kMDItemFSCreationDate < $time.iso(2023-08-14 21:14:20)'

This returned no results... not even the file in question was returned.

What am I doing incorrectly here?

2
  • I have answered your question below, but your "real" question might be what is a .lldb_info file.
    – Gilby
    Sep 14, 2023 at 0:31
  • That is part of it. And having general knowledge and a method of determining what files are, how they were installed and by what program - without having to do a search.
    – John
    Sep 18, 2023 at 17:09

1 Answer 1

1

I can confirm the behaviour you are seeing with a test on my Mac. But that is only when I, like you, enter the time without the time zone.

The file creation date/time is 2023-08-14 21:14:13 +0000 (as in your mdls output). The Spotlight index is storing date/time as in time zone +00. So you need to specify that time zone in your mdfind. Try this:

mdfind 'kMDItemFSCreationDate > $time.iso(2023-08-14 21:14:00 +0000) && kMDItemFSCreationDate < $time.iso(2023-08-14 21:14:20 +0000)'

The equivalent works for my test file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .