Follow-up question about resource forks and how it affects my data archival.

[harrisonjr98]

Hey all! Noticed a week ago that I had some files on an external drive where windows properties showed basically twice as many files as I could see on the Mac, and then discovered they were hidden 4KB files managed by macOS that seem to be called resource forks. I have heard of resource forks before but was under the impression that they only appeared on HFS/APFS formatted volumes and not an exFAT external drive.

I am just trying to iron out what to make of them. I share that drive between a mac and pc regularly and use it for archival of photos and music. My music folder doesn't read in windows as having twice as many files as it does on mac, nor does my "actual" photography library. Just my Google Photos offline backup that I recently downloaded. Why did these files make "forks" but nothing else did? Is this intentional or anything to worry about? What *are* these files, if I had downloaded the photos on windows and moved them to the drive, would macOS make these resource forks for itself? Or is it just because I managed the files via macOS originally?

Thanks so much for any guidance you're able to provide. This forum is an incredible resource.

 

[joevt]

Files on Macs may have resource forks (or even other forks?) as well as the usual data fork. A resource fork will appear as an extended attribute in macOS. The FAT file system doesn't have a method to store other forks or extended attributes so Apple stores an invisible file (starts with a period .) for those files.

You can create a file with a resource fork using the macOS Finder by copying an image and pasting it onto the icon of a file or folder to change the item's icon.

If you do this to a volume, you get a file called .VolumeIcon.icns which just has a data fork and maybe some extended attributes. The name starts with a period . to make it invisible. The icns file has a similar format to the icns resource type.

bash-3.2$ ls -lA@ /Volumes/Lion/.VolumeIcon.icns
-rw-r--r--  1 joevt  admin  581358 22 Mar  2020 /Volumes/Lion/.VolumeIcon.icns

If you add an icon to a folder (not a volume), then you create an invisible file named "Icon" with a carriage return character (ASCII 13 or 0x0D) at the end of the file name (use $'\r' to specify a carriage return character in bash or zsh in Terminal.app). It has a resource fork containing an icns resource which contains the icons of various sizes for the folder. The com.apple.FinderInfo extended attribute for the folder has a bit to indicate the file has a custom icon. The com.apple.FinderInfo extended attribute for the Icon file has a bit to indicate the file is invisible. In the example below, the Icon file contains multiple icon resource types (not icns) because it was created by an older macOS version.

xattr -l /Volumes/Apps/Tools
com.apple.FinderInfo:
00000000  01 68 02 3A 02 BF 04 03 07 0C 00 CC 00 01 01 C8  |.h.:............|
00000010  00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00  |........@.......|
00000020

ls -lA@ /Volumes/Apps/Tools/Icon$'\r'
-rwxr-xr-x@ 1 joevt  staff  0 10 Nov  1996 /Volumes/Apps/Tools/Icon?
	com.apple.FinderInfo	32 
	com.apple.ResourceFork	2670 

derez -only 'xxxx' -p /Volumes/Apps/Tools/Icon$'\r'
DeRez V3.7  
Copyright Apple Computer, Inc. 1986-2018

: ### DeRez - Skipping 'ICN#' (-16455).
: ### DeRez - Skipping 'icl8' (-16455).
: ### DeRez - Skipping 'icl4' (-16455).
: ### DeRez - Skipping 'ics#' (-16455).
: ### DeRez - Skipping 'ics8' (-16455).
: ### DeRez - Skipping 'ics4' (-16455).

derez -only ics4 /Volumes/Apps/Tools/Icon$'\r'
data 'ics4' (-16455) {
	$"0000 0000 0000 0000 0000 0000 0000 0000"            /* ................ */
	$"0000 0000 0000 0000 00FF FF00 0000 0000"            /* .........??..... */
	$"0FCC CCF0 0000 0000 FCCC CCCF FFFF FFF0"            /* .???....???????? */
	$"F0C0 C0C0 C0C0 C0CF FC0C 0C0C 0C0C 0CCF"            /* ?????????......? */
	$"F0C0 C0C0 C0FF F0CF FC0C 0C0C 0C0F FFCF"            /* ?????????.....?? */
	$"F0FF FFFF FFFF DFCF FCFF FFFF FFFF DFCF"            /* ???????????????? */
	$"F0CC CCCC CCCF FCCF FC0C 0C0C 0C0F DFCF"            /* ?????????.....?? */
	$"F0C0 C0C0 C0CF FFCF FFFF FFFF FFFF FFFF"            /* ???????????????? */
};

Notice that the ls command replaces the carriage return in the Icon file name with a ? wild card character. I'm not sure what Windows shows in this case.


If you add an icon to a file, then the file gets icon resource(s) added to its resource fork. If it doesn't have a resource fork then one is added. The com.apple.FinderInfo extended attribute for the file has a bit to indicate the file has a custom icon.

ls -lA@ testfilewithcustomicon.txt
-rwxr-xr-x@ 1 joevt  staff  266  1 Apr 21:48 testfilewithcustomicon.txt
	com.apple.FinderInfo	 32 
	com.apple.ResourceFork	1211701 

derez -only 'xxxx' -p testfilewithcustomicon.txt
DeRez V3.7  
Copyright Apple Computer, Inc. 1986-2018

testfilewithcustomicon.txt: ### DeRez - Skipping 'icns' (-16455).

Now when all of these exist on a FAT formatted partition, then we see this:

ls -lA@R /Volumes/FREEDOS/Icons  
total 16
-rwxrwxrwx  1 joevt  staff  4096  1 Apr 21:57 ._Windows 8 or 10
drwxrwxrwx@ 1 joevt  staff  4096  1 Apr 21:58 Windows 8 or 10
	com.apple.FinderInfo	  32 

/Volumes/FREEDOS/Icons/Windows 8 or 10:
total 8496
-rwxrwxrwx@ 1 joevt  staff   416157 15 Feb  2020 .VolumeIcon.icns
	com.apple.FinderInfo	     32 
-rwxrwxrwx  1 joevt  staff     4096  1 Apr 21:56 ._.VolumeIcon.icns
-rwxrwxrwx  1 joevt  staff   746029  1 Apr 21:57 ._Icon?
-rwxrwxrwx  1 joevt  staff  1215511  1 Apr 21:58 ._testfilewithcustomicon.txt
-rwxrwxrwx@ 1 joevt  staff        0  1 Apr 21:57 Icon?
	com.apple.FinderInfo	     32 
	com.apple.ResourceFork	 742219 
-rwxrwxrwx@ 1 joevt  staff      266  1 Apr 21:48 testfilewithcustomicon.txt
	com.apple.FinderInfo	     32 
	com.apple.ResourceFork	1211701

You see the folder Windows 8 or 10 has a custom icon Icon? and therefore has a com.apple.FinderInfo extended attribute for the custom icon flag bit. The extended attribute is actually stored in a file ._Windows 8 or 10 in the same directory Icons as the folder.

The .VolumeIcon.icns, Icon?, and testfilewithcustomicon.txt files each have a corresponding file with the same name but with a ._ prefix. That's where their extended properties and resource forks are contained.

 

[joevt]

Search for AppleDouble in wikipedia or whatever for more info. I didn't check if the format of the ._ files matches the description of AppleDouble.

 

[harrisonjr98]

Search for AppleDouble in wikipedia or whatever for more info. I didn't check if the format of the ._ files matches the description of AppleDouble.

I guess my biggest question remaining is why it generated these forks for some but not all files on the drive. I will probably go ahead and move those files to an HFS+ formatted drive soon, presumably the forks will combine properly since HFS+ natively supports their metadata?

 

[joevt]

I guess my biggest question remaining is why it generated these forks for some but not all files on the drive. I will probably go ahead and move those files to an HFS+ formatted drive soon, presumably the forks will combine properly since HFS+ natively supports their metadata?

Yes, copying the file to HFS+ will recombine them properly but only if you use an AppleDouble aware method to copy the files such as the Finder.
Most files don't need a resource fork or extended attributes.
I showed some commands you can use to examine the resource fork and extended attributes so you can see if they have anything you need to keep.

 

[harrisonjr98]

Yes, copying the file to HFS+ will recombine them properly but only if you use an AppleDouble aware method to copy the files such as the Finder.
Most files don't need a resource fork or extended attributes.
I showed some commands you can use to examine the resource fork and extended attributes so you can see if they have anything you need to keep.

I appreciate that - frankly your breakdown is a bit over my head, but I very much appreciate it regardless. I will copy the files over and quit worrying, I think