._ File Format

Introduction

A Macintosh file can carry more than its contents: a resource fork, the Finder’s type and creator codes and flags, a comment, and on macOS extended attributes such as the quarantine flag set on downloads. Most other file systems have nowhere to keep them. AppleDouble and AppleSingle are Apple’s two ways of carrying them anyway, and Apple published both in a developer note, AppleSingle/AppleDouble Formats for Foreign Files. Version 2 is the one in use.

• AppleDouble splits a file in two: the contents stay in an ordinary file, and everything else goes into a “header file” beside it. When macOS copies a file to a FAT or exFAT drive or to a network share that cannot store these parts, it writes that header file under the same name with ._ in front: photo.jpg gets ._photo.jpg. The Finder’s Compress command does the same inside ZIP files, in a __MACOSX folder, and macOS’s tar writes them as members just before each file.
• AppleSingle keeps the contents and the rest together in one file.

On a Mac, dot_clean merges ._ files back into the files they belong to. Other systems show them as small extra files, usually 4,096 bytes, that can be deleted if the Mac information is not needed. RFC 1740 uses both formats to send Mac files by email, as application/applefile.

Structure

Both formats have the same layout: a 26-byte header, a table of entries, then the entries themselves, in any order. Numbers are big-endian. Only the magic number tells them apart.

In version 1 the filler named the file system the file came from, such as Macintosh or ProDOS, padded with spaces, and entry 7 held the file information in that system’s own layout.

Entries

Each descriptor gives an entry’s ID, its offset from the start of the file and its length. The IDs the developer note defines are:

A ._ file from macOS has just two entries: Finder info (9) and the resource fork (2), which is 286 bytes for a file that has no resources of its own.

Finder info

The first 16 bytes are the file type and creator (four characters each, such as TEXT and ttxt), the Finder flags (invisible, custom icon, alias, the colour label), the icon’s position in its window and its folder. The next 16 hold the icon ID, the script of the name, more flags, the comment ID and the folder the file is put back in.

Extended attributes

macOS makes the Finder info entry longer than 32 bytes and keeps the file’s extended attributes in it, after two bytes of padding. An attribute header starts with ATTR and gives the total size, where the values are and how many attributes there are. One entry per attribute follows (the value’s offset and length, flags, and the name in UTF-8 with its length), padded to a multiple of 4 bytes, then the values. The rest of the entry is zeros, left free so attributes can be added. Common ones are com.apple.quarantine, the download’s app and time, and Spotlight’s com.apple.metadata: attributes, such as the address a file was downloaded from, which are binary property lists.

Resource fork

The resource fork has a 16-byte header giving the offsets and lengths of the resource data and the resource map, usually followed by 240 reserved bytes. Each resource’s data is a 4-byte length and the bytes. The map lists the types, such as icns for a custom icon, then for each resource its ID, name, attributes and where its data is, and ends with the names.

Links