This part is not in Apple’s note or RFC 1740. When macOS writes a ._ file it
makes the Finder info entry longer than
its 32 bytes and keeps the file’s extended attributes inside it. The layout comes from the
macOS kernel’s source, vfs_xattr.c.
Numbers are big-endian, and the offsets below are from the start of the file.
Where it sits
After the Finder’s 32 bytes come 2 bytes of padding, which put the rest on a 4-byte boundary in the file. Then the attribute header, one entry per attribute, the attributes’ values, and zeros up to the end of the entry. The Finder info entry is followed by the resource fork, so the free space lets attributes be added without moving the fork.
+0Finder info the 32 bytes32 bytes+32Padding2 bytes+34Attribute header starts withATTR36 bytes+70Attribute entries one per attribute, each padded to a multiple of 4 bytesvaries…Values at the offsets the entries givevaries…Free space zeros up to the end of the entryvaries
Attribute header
| Offset | Size | Field | Meaning |
|---|---|---|---|
| +0 | 4 | Magic | ATTR (41545452) |
| +4 | 4 | Debug tag | For debugging: the file ID of the file these attributes belong to |
| +8 | 4 | Total size | The file offset of the end of the header, entries and values |
| +12 | 4 | Data start | The file offset of the attribute values |
| +16 | 4 | Data length | The length of the values together |
| +20 | 12 | Reserved | Three 32-bit words |
| +32 | 2 | Flags | xnu defines no values for it |
| +34 | 2 | Number of attributes | How many entries follow |
The offsets in this table are counted from the start of the attribute header, which is 34 bytes into the Finder info entry.
Attribute entries
| Offset | Size | Field | Meaning |
|---|---|---|---|
| +0 | 4 | Offset | The file offset of the value |
| +4 | 4 | Length | The value’s length |
| +8 | 2 | Flags | xnu defines no values for it, and writes 0 |
| +10 | 1 | Name length | The length of the name, counting its NUL |
| +11 | varies | Name | In UTF-8, ended by a NUL |
| … | 0–3 | Padding | Zeros, up to a multiple of 4 bytes for the whole entry |
Limits
- The header and entries must fit into 64K (
ATTR_MAX_HDR_SIZE); the values may go beyond it. - A name is at most 128 bytes with its NUL.
- The Finder information and the resource fork are stored in entries 9 and 2, not as attributes.
Common attributes
| Name | Value |
|---|---|
com.apple.FinderInfo | 32 bytes laid out like the Finder info |
com.apple.metadata:… | Spotlight’s attributes, such as kMDItemWhereFroms, the address a file was downloaded from; binary property lists |
com.apple.quarantine | Marks a file as downloaded. A short text value; Apple publishes no layout for it |