Is it possible to hide files from Terminal's ls?

I am saving some files because I need to reinstall OS X, and noticed oddly high numbers of files in some folders. Is it possible for malware to hide files from ls?


Hidden files are hidden from ls unless you use the -a or -A flag:

-A   List all entries except for . and ...  Always set for the super-user.
-a   Include directory entries whose names begin with a dot (.).

Source: ls man page

Therefore, files can be hidden by starting the filename with a . but ls will still show the file if it is run with -a or -A.

Note that not all files that are hidden with a . are malware-related. The system creates many files like this for a variety of reasons in various places on the disk that can cause problems if removed or modified.


ls is not a command that opens the directory file itself and show it's contents. It uses dirent (Directory Entries) from the C library which is used by a lot of software like stat but also bash's parameter expansion.

So the real question is then: Is it possible for malware to hide files from BSD/Darwin? No, you can't hide files from it's own system because it will turn into waste (read:free to overwrite) very soon.