Section 9.3. Hidden Files

9.3. Hidden Files

By default, the Finder hides many files and folders from view, including the entirety of Darwin's directory layout, under the philosophy that most Mac OS X users will never need to access the system's Unix underpinnings. Savvier users, on the other hand, have a number of ways to see and work with all the filesystem's files.

9.3.1. Seeing Hidden Files

There are two ways to see files that don't appear in the Finder. The most direct way involves simply viewing a folder's contents by running the ls command on it in the Terminal. The Terminal sees the world simply as a tree of directories and files, and nothing more; files that have special, Mac-specific system roles appear like any other file. (However, you'll have to run ls with the -a flag.)

The other way involves changing the Finder preference that keeps these files hidden from sight. (Apple gets points for making this a user -adjustable preference, albeit not a very obvious one.) You'll need to add a value to the Finder preferences' file. You can accomplish this by operating the defaults command-line program on your com.apple.finder user defaults domain (described in Chapter 13), or by directly editing your /Users/ username /Library/Preferences/com.apple.finder. plist file with the Property List Editor application, as shown in Figure 9-2.

Figure 9-2. The Finder's preferences, as seen in Property List Editor

To add a value to the com.apple.finder.plist file, follow these steps:

1. Launch the Property List Editor ( /Developer/Applications/Utilities ).

2. Open the com.apple.finder.plist file located in /Users/ username /Library/Preferences .

3. Click on the disclosure triangle next to Root to reveal the values and keys for the Finder's preferences.

4. Select Root by clicking on it once.

5. Click on the New Child button.

6. In the first column, enter AppleShowAllFiles .

7. Change its class to Boolean .

8. Change its value to Yes .

9. Save the changes to the plist file (File Save, or -S).

10. Quit the Property List Editor ( -Q).

Your work's almost over. To make the changes take effect, you need to relaunch the Finder, as follows :

1. Go to Force Quit (or Option- -Esc).

2. Select the Finder.

3. Click the Relaunch button.

There will be a short pause while the process for the Finder quits and restarts, after which the changes you made will take effect.

If you already know about a Finder-hidden folder's existence, you can view its contents in the Finder by choosing Go to Folder (Shift- -G) and then typing the path to that folder. Typing /bin , for example, reveals the contents of that directory.

9.3.2. Dotfiles

Following the traditional Unix model, the Finder hides all dotfiles , which are simply files (or folders) whose names begin with a period (dot) character. Applications can access dotfiles like any other file.

Your Mac's filesystem will likely accrue many dotfiles over time, particularly in users' Home folders, since this is the typical location for legacy Unix applications to store preference and configuration files. (Mac OS X-specific applications prefer to store this sort of information in Library folders, as described in the earlier section "The Library folder".) The following list covers some of particular interest:

.bash_history

Found in the user's Home directory, this file is used by the bash shell to record previously entered commands.

.FBCIndex , .FBCLockFolder

The Finder creates these dotfiles in each directory that it indexes by content. The binary file, FBCIndex , acts as an index to the content of all the folder's files. When performing a by-content search via the Finder's Find command, the Finder quickly reads from these index files, rather than picking through all the individual files again.

.ssh

When you access another computer via the Secure Shell (SSH), an encrypted RSA key is stored in the known_hosts file within this directory.

.Trash

Found in users' Home folders, this directory contains all the files and folders that a user has sent to the Trash (through either the Dock's Trash icon or the Finder's Move to Trash ( -Delete) command) but not yet deleted. When a user clicks once on the Dock's Trash icon, this folder's contents appear in a special Finder window labeled Trash.

This knowledge is useful for accessing users' Trash folders from the Terminal, or doing it programmatically through Perl or a shell script.

Mac OS 9 , if present, also keeps its system-wide Trash as a hidden folder, separate from the Trash folder in each Mac OS X user's Home folder. See "Hidden Mac OS 9 files", later in this chapter.

9.3.3. Exploring root

The root directory of a Mac OS X boot disk has the most to hide, from the Finder's point of view; it may play root to as many as three separate operating systems' filesystems, all at once! Beyond holding the lowest -level directories of the Mac OS X filesystem, such as the /System and /Library folders, the root directory also contains the basic directories that Darwinthe pure Unix system running at Mac OS X's coreneeds. These include the directories that any Unix user would recognize, such as /etc and /tmp . Compare Figure 9-3 with Figure 9-4.

Furthermore, if Mac OS 9 is installed on the boot disk, its System Folder appears under the root directory, as do several Mac OS 9 configuration files. Other arbitrary files and folders created by the Mac OS 9 application might also exist at root because that operating system lacks Mac OS X's permission system and doesn't view the root directory as "sacred ground." For example, many Mac OS 9 software installers create new folders directly under root ; Mac OS X installers place their software in locations such as /Applications/Library .

Mac OS X's Finder, when displaying the boot disk's root folder, will show most of the low-level Mac OS X and Mac OS 9 filesystems' folders, but keep several special files hidden from sight, and it won't show any of Darwin's directories.

9.3.3.1. Hidden Mac OS 9 files

This isn't a book about Mac OS 9, so we won't go into detail about these files' functions. However, it's worthwhile to point out their presence on disks on which Mac OS 9 and Mac OS X are both installed because their mysterious existence might otherwise prove confusing.

All of these exist under the boot volume's root directory ( / ). Mac OS 9 is a single-user system, so it finds no fault in writing files directly to / , even though that's considered sacred ground to any Unix system, including Mac OS X.

Figure 9-3. A typical Finder view of the boot disk's root

Figure 9-4. The same view, with hidden files revealed

Here are a few of the more common Mac OS 9 hidden files:

• Cleanup At Startup

• Desktop DB

• Desktop DF

• Temporary Items

• TheFindByContentFolder

• TheVolumeSettingsFolder

• Trash

As a rule of thumb, if you see mysterious, hidden files lurking directly under the root directory, they're probably the doing of Mac OS 9.

9.3.3.2. Hidden Darwin files

This book frequently mentions "traditional Unix systems" when comparing Mac OS X to other Unix-based operating systems. The truth is that Darwin (already noted) is a rather traditional Unix system, when considered all by itself. It has its own directory structure that subtly shares disk space with the more visible Mac OS X structure covered in the earlier section "Filesystem Organization."

All these files and directories exist under the root directory ( / ). (This may make them sound like the hidden Mac OS 9 files described in the previous section, but they're quite different. They serve as the core of the Darwin system, and hence of Mac OS X itself, in a way.)

mach

mach.sym

mach_kernel

These files make up the Mach kernel, the heart of Darwin and Mac OS X.

etc

private/etc

/etc is actually a symbolic link to /private/etc , a directory that holds Darwin's system configuration files. While many of these files, such as hosts and passwd , have roles superceded by Mac OS X's Directory Service technologies, others, such as hostconfig , are central to the whole operating system's configuration, especially during the startup process.

tmp

private/tmp

Again, /tmp is a symbolic link to /private/tmp . The usual Unix tmp directory is readable and writeable by all users and processes, despite the fact that it's hidden in the invisible /private directory. Lots of command-line programs and utilities use this directory as a scratch pad to write temporary files to disk. (Modern Mac OS X applications are more likely to use users' Library folders.)

var

private/var

/var is a symbolic link to the /private/var directory, which holds logs, spools, PID files, and other file-based resources used by active processes. Most importantly, /private/var/db holds vital configuration data including the NetInfo databases.

bin

Core Terminal commands, such as cp and mkdir . (As with all Unix command-line functions, all these commands, even the seemingly simple ones such as ls , are executable program files.)

sbin

Command-line utilities to perform basic filesystem and other administrative operations, such as mounting, unmounting, configuring, and diagnosing disks. Because these commands affect the whole system, they must usually be run as root .

automount

The system uses this directory as a mount point when statically mounting networked volumes .

dev

Device files, each a pointer to some kind of Unix device the system supports, are both real (such as disks and their partitions) and virtual (such as /dev/null ).

Volumes

This is the default mount point Mac OS X uses for the filesystems of disks and partitions other than the boot volume. One subdirectory appears here for every disk (except for the boot disk and Network icon) that the Finder displays in the top-half of the Sidebar.