Hidden Files

Ignorance might be bliss, but knowledge is fun.

Get It Try It

Following is a summary of what you won't normally see on your Aqua desktop.

._*

File names which begin with a dot and an underscore are used on volumes which do not support Apple's file system HFS+. They contain resources - ie stuff normally hidden away in resource forks. Your first OS X startup CD will have such a file - if you try to make a copy of your startup CD with Finder, Finder will miss this file and your startup CD will not work.

.DS_Store

An insidious bastard. You're losing major tonnage because Aqua wants to be able to let you have fancy schmancy folder settings for each and every folder you ever use. But these files can grow as large as 25KB or more. Multiply that by the number of folders you have on disk, and you begin to see where your precious disk free space has gone off to.

.hidden

A true conspirator. Dot files are never visible, and this one is a repository for the names of other files the system wants the Finder to keep invisible. The Finder reads this file first when it comes to a new folder. Nothing in this file is listed.

~/.Trash

This is your trash bin. It's invisible because its name begins with a dot. It's right there in your home directory.

/.Trashes

Found also at root level on mounted volumes. Root access only.

/.vol

A very funky directory found on HFS volumes. Invoke an inode (CNID) from the subfolder you find here and your file will open. Note that this is kind of tacky as Unix does not admit of a 'one on one' from ID to path (and not many other file systems are locked into this either) but HFS depends on it. Used by Carbon (and Classic) apps that can't reach Unix APIs.

/bin

May or may not be visible on your system. The original repository for Unix 'binaries' (programs).

/cores

Where core dumps go - copies of system memory saved to disk in the event of a program crash. With today's massive RAM configurations, it's a good thing this facility doesn't get used too often.

/dev

Dennis Ritchie's contribution to Unix ideas. This folder contains your device drivers as readable and writable 'files'. Just don't try anything stupid. There are some cool tricks you can try, but you have to know what you are doing.

/dev/fd

File descriptor stuff.

/etc

Symlink to /private/etc. Contains well known files such as the authentication files passwd and its backup copy opasswd. Otherwise contains configuration files and scripts. OS X's NetInfo overrides a lot of this, but it's still here for use in single user mode.

/mach, /mach.sym, /mach_kernel

Your OS X MACH kernel. /mach is a symlink to mach.sym.

/private

Where a lot of the traditional Unix stuff ends up on OS X. You'll find a tmp directory here, your virtual memory swap file, as well as various system logs.

/sbin

A directory for 'system binaries' such as fsck.

/tmp

Your designated directory for temporary files. Symlink to /private/tmp.

/usr

Original 'user' file hive. Contains two directories for binaries. Could often be located on a separate physical disk and mounted after system boot. Also contains compiler 'include' files.

/var

Symlink to /private/var.

/var/root

Root's home directory. You have to be root to get in here.

/var/run

Includes a startup items subdirectory and the 'sudoers' subdirectory sudo. Also contains the file utmp used by the who command.

/var/vm

Your virtual memory storage is here. Can also contain the app_profile subdirectory, with a mapping of your system activities.

/Volumes

Where external mounts go.

How Invisible?

There are three ways to make an item invisible under OS X - at least in the Finder:

1. HFS+ has an 'invisible' attribute which is still in use on OS X. This is not compatible with Unix or UFS and will have no effect a Unix file browser.

2. The file or directory can be listed in the file .hidden found in the same directory. This is a plain text file. All you need to do to make these items visible is change the file name, eg to hidden. Normally you're better off with this stuff safely out of the way. This affects only the Finder and the OS X file dialogs.

3. The file name begins with a dot ('.'). This is a traditional Unix device - the '-a' ('all') switch in the command 'ls -al' overrides this, listing even these files.
   (Note that this does not imply the file is a 'system file' or anything of the sort, as OS X file dialogs will claim. You can use any dotted file name you want for anything you want: Unix has no opinion in the matter - only Cupertino.)

Shareware authors regularly exploit the ability to hide files on your system so you won't use their products without paying. To see what they're up to, you need a better tool than the Finder.

Beware of 'ISV' (3rd party) apps demanding your administrator password. They have no business going into your system areas - not even to /Applications - and should be installed in your own ~/Applications directory. Moreover, these products will often use your password to hide things on your disk. For an example of how bad it can get, see this link.

One thing you can do right now is learn the Unix find command, available in your Terminal. The -newer switch can be used to compare and list all files 'newer' than a file you specify, such as the software you just downloaded.

If you do too many things between the download and the software test, save an empty file to disk immediately before running the download for the first time and use that file with the find -newer command instead.

Remember to escalate to root as well but disconnect from the net before so doing): you need to be able to see all areas of your disk the download might have got into. Disregard anything in /dev and concentrate on real directories. Use a good file browser tool to investigate each file you find - such as this one.