Leopards extended file attributes (Time Machine and Quarantine)
Recently, I discovered something interesting about the HFS+ filesystem features in Mac OS X 10.5 Leopard. I don't know whether these features were present in earlier versions of OS X, they weren't used in the way they are now however.
I was wondering how Apple's new backup feature "Time Machine" works. When looking at a time machine partition with the terminal, all the files that haven't changed are simply hard links. However, when I listed them with 'ls -al', I saw a an attribute I haven't seen before:
-rw-r--r--@ 2 chris staff 14M Jan 27 13:58 stoel.mov
-rw-r--r--@ 2 chris staff 12M Aug 9 05:31 tony vs paul.flv
-rw-r--r--@ 1 chris staff 59M Jan 28 20:40 visiting shoes.mov
Also, this '@' sign is present on other files sometimes. The man page of ls says:
-@ Display extended attribute keys and sizes.
I also discovered this attribute on another bunch of files I recently downloaded. The strange thing about these files was that I couldn't modify or move them: the Finder (and 'mv') wouldn't allow me to. After some googling, I found this link that explained why.
The '@' sign indicates that there are extended attributes in place on the file. You can list them with ls -@, and you can get and set them with 'xattr'. On the files I couldn't modify, I saw there was a 'com.apple.quarantine' attribute in effect. After removign it with 'xattr' I could move them again.
Back to Time Machine. The files in Time Machine have many attributes, for example:
Appelflap:Stop Motion chris$ xattr -l stoel.mov
com.apple.FinderInfo:
0000 4D 6F 6F 56 69 53 74 6F 00 00 00 00 00 00 00 00 MooViSto........
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
com.apple.metadata:_kTimeMachineNewestSnapshot:
0000 62 70 6C 69 73 74 30 30 33 42 2D 63 C3 7F 00 00 bplist003B-c....
0010 00 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 ................
0020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 11 ..
com.apple.metadata:_kTimeMachineOldestSnapshot:
0000 62 70 6C 69 73 74 30 30 33 41 AA 9B A8 BA 00 00 bplist003A......
0010 00 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 ................
0020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 11 ..
Appelflap:Stop Motion chris$ xattr -l tony\ vs\ paul.flv
com.apple.metadata:_kTimeMachineNewestSnapshot:
0000 62 70 6C 69 73 74 30 30 33 42 2D 63 C3 7F 00 00 bplist003B-c....
0010 00 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 ................
0020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 11 ..
com.apple.metadata:_kTimeMachineOldestSnapshot:
0000 62 70 6C 69 73 74 30 30 33 41 AA 9B A8 BA 00 00 bplist003A......
0010 00 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 ................
0020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 11 ..
com.apple.metadata:kMDItemWhereFroms:
0000 62 70 6C 69 73 74 30 30 A2 01 02 5F 10 42 68 74 bplist00..._.Bht
0010 74 70 3A 2F 2F 61 73 68 2D 76 31 30 30 2E 61 73 tp://ash-v100.as
0020 68 2E 79 6F 75 74 75 62 65 2E 63 6F 6D 2F 67 65 h.youtube.com/ge
0030 74 5F 76 69 64 65 6F 2E 66 6C 76 3F 76 69 64 65 t_video.flv?vide
0040 6F 5F 69 64 3D 41 4A 7A 55 33 4E 6A 44 69 6B 59 o_id=AJzU3NjDikY
0050 5F 10 21 68 74 74 70 3A 2F 2F 6D 65 67 61 75 70 _.!http://megaup
0060 6C 6F 61 64 2E 6E 65 74 2F 6B 65 65 70 76 69 64 load.net/keepvid
0070 2E 70 68 70 08 0B 50 00 00 00 00 00 00 01 01 00 .php..P.........
0080 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 ................
0090 00 00 00 00 00 00 74 ......t
com.apple.quarantine: 0000;479afced;Safari;51D09ED4-1818-4136-A801-52237BD2E12E|com.apple.Safari
Appelflap:Stop Motion chris$
While these attributes are binary, they reveal some information. The "com.apple.metadata:kMDItemWhereFroms" attribute shows the URL I downloaded the movie from, which is keepvid.com. The other properties have to do with version control in time machine.
Interesting stuff. I haven't found the time yet to dig deeper into time machine and see what it does with diffs and all, for now it seems like it just hardlinks unchanged files and uses these 'extended properties' for version management. Which explains why it only works on HFS+ 
My first youtube post
Recently I figured that I cannot be a true student of Telematics, semi-geek or internet professional without actively participating in the Web 2.0 thing. I'm already on last.fm, linkedin, 43things and plaxo, but I have never posted a film to youtube!
Combined with this great new app I bought, iStopMotion, and an evening with a good friend, it resulted in a short stop-motion film. You can watch it at youtube or embedded here. It is about a pair of shoes visiting a friend and having a beer together
Have fun!