What's inside the __MACOSX hidden folder in zip files created in Mac OS

user_8117600 0
Viewed 2879

I am a Windows user and my application accepts zip files.

I realized that when the user compresses files with the built in zip compressor in Mac OSX, it results in an extra folder titled "__MACOSX" created in the extracted zip.

I need to handle this folder(__MACOSX) in my application. I just want to know what is in the hidden __MACOSX directory. Is it empty or does it contain some files? And if it contains files, then how many files does it contain? If there are files, is the number of files fixed? What kind of files are there (empty/non-empty etc.)? Need full info.

It's simple to check in Mac OS but I don't have a Mac so I can't figure out what is there in this folder. I searched but couldn't find the answer.

zip macos
2 Answers

I zipped a folder "Pack" containing the following:

  • Readme.txt
  • Image.jpg
  • Script.sh
  • Sound.m4a

What's inside "__MACOSX":

  • Pack (folder)
  • Pack/.Readme.txt (file)
  • Pack/.Image.jpg (file)
  • Pack/.Script.sh (file)

So it seems "__MACOSX" contains a replication of the folder structure being zipped, with hidden files starting with a dot, instead of the real files. However, not all files are there, so it might be difficult to predict how many files (in my test, the real file Sound.m4a don't have a .Sound.m4a equivalent.)

Those "hidden" files are not empty, they are binary files holding metadata.

Why don't you just ignore this "__MACOSX" folder, and delete it, instead of processing it?

user_41198090

Just to add to @Yoric's answer, the hidden files are written in the AppleDouble format, which is originally used to store additional metadata on Unix systems.

Example (GraCoL 2013 ICC):

unzip -d swop SWOP2013_and_GRACoL2013_ICC_Profiles.zip
file swop/__MACOSX/._GRACoL2013_CRPC6.icc
# swop/__MACOSX/._GRACoL2013_CRPC6.icc: AppleDouble encoded Macintosh file

Even without knowing the file format (documented in RFC 1740), you can more or less figure out what is saying. In our case:

$ hexdump -C swop/__MACOSX/._GRACoL2013_CRPC6.icc
00000000  00 05 16 07 00 02 00 00  4d 61 63 20 4f 53 20 58  |........Mac OS X|
00000010  20 20 20 20 20 20 20 20  00 02 00 00 00 09 00 00  |        ........|
00000020  00 32 00 00 00 c2 00 00  00 02 00 00 00 f4 00 00  |.2..............|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000050  00 00 00 00 41 54 54 52  00 00 00 00 00 00 00 f4  |....ATTR........|
00000060  00 00 00 98 00 00 00 5c  00 00 00 00 00 00 00 00  |.......\........|
00000070  00 00 00 00 00 00 00 01  00 00 00 98 00 00 00 5c  |...............\|
00000080  00 00 15 63 6f 6d 2e 61  70 70 6c 65 2e 71 75 61  |...com.apple.qua|
00000090  72 61 6e 74 69 6e 65 00  71 2f 30 30 30 31 3b 35  |rantine.q/0001;5|
000000a0  32 33 39 64 33 32 37 3b  47 6f 6f 67 6c 65 5c 78  |239d327;Google\x|
000000b0  32 30 43 68 72 6f 6d 65  2e 61 70 70 3b 31 33 41  |20Chrome.app;13A|
000000c0  39 30 46 46 32 2d 34 43  45 41 2d 34 35 37 33 2d  |90FF2-4CEA-4573-|
000000d0  38 37 45 32 2d 32 35 33  41 37 30 35 38 30 34 39  |87E2-253A7058049|
000000e0  44 7c 63 6f 6d 2e 67 6f  6f 67 6c 65 2e 43 68 72  |D|com.google.Chr|
000000f0  6f 6d 65 00                                       |ome.|
000000f4

We are looking at an instance of the com.apple.quarantine extended attribute, which in this case says the file was downloaded with Chrome. Well, at least it was the case for whoever packed this zip file.

user_37702600
Related