Entry 2 holds the Macintosh resource fork as a byte stream, in the layout the Resource Manager uses on disk. Numbers are big-endian. The offsets below are from the start of the fork. What each resource type means inside its data is the business of that type and is not part of this format.
Header
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 4 | Data offset | Where the resource data starts |
| 4 | 4 | Map offset | Where the resource map starts |
| 8 | 4 | Data length | The length of the resource data |
| 12 | 4 | Map length | The length of the resource map |
| 16 | 112 | System data | Reserved for the system’s use |
| 128 | 128 | Application data | Free for the application’s use |
The resource data usually starts at offset 256, after these reserved bytes.
Resource data
Each resource is a 4-byte length followed by its bytes, and the map says where each one starts.
Resource map
Offsets in this table are from the start of the map.
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 16 | Copy of the header | The 16 bytes above, or zeros; the Resource Manager does not read it |
| 16 | 4 | Next map | A handle, filled in in memory |
| 20 | 2 | File reference | Filled in in memory |
| 22 | 2 | Attributes | See below |
| 24 | 2 | Type list offset | From the start of the map |
| 26 | 2 | Name list offset | From the start of the map |
Map attributes
| Mask | Attribute |
|---|---|
0080 | Read-only |
0040 | Compact: the fork is to be compacted when written |
0020 | Changed: the map is to be written |
Type list
At the type list offset: a 2-byte count of types less one (FFFF means none),
then one 8-byte item per type.
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 4 | Type | Four characters, such as icns for a custom icon |
| 4 | 2 | Number less one | The number of resources of this type, less one |
| 6 | 2 | Reference list offset | From the start of the type list |
Reference lists
One 12-byte reference per resource of a type, in a list for each type.
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 2 | ID | Signed, unique within the type |
| 2 | 2 | Name offset | From the start of the name list; FFFF for no name |
| 4 | 1 | Attributes | See below |
| 5 | 3 | Data offset | From the start of the resource data |
| 8 | 4 | Handle | Filled in in memory |
Resource attributes
| Mask | Name | Meaning |
|---|---|---|
80 | System reference | A reference to the system or a local one |
40 | System heap | Read into the system heap rather than the application heap |
20 | Purgeable | May be purged from memory |
10 | Locked | Locked in memory |
08 | Protected | May not be changed |
04 | Preload | Read in when the fork is opened |
02 | Changed | To be written to the fork |
01 | Reserved | No name in Apple’s headers |
Name list
The names of the resources that have one, as Pascal strings: a length byte, then that many characters. References point into it by offset.
An empty fork
In a ._ file for a file that has no resources, macOS writes a 286-byte fork:
the header, 240 reserved bytes and a map of 30 bytes with no types. The first 46 bytes of
the system data are the sentence “This resource fork intentionally left blank”, padded
with spaces.