Massive Amount of Random Files appearing in Documents

Really hope someone can help me with this issue!

For the past few months, I have had an annoying issue whereby I have multiple 2-character 0-byte random folders appearing within Documents, along with an index.dat file at the very top which seems to form the quickest. It appears to only happen when I use Safari, but I have become quite attached to the browser so would prefer to continue doing so.

I have tried deleting all cookies and updated to the latest macOS, but to no avail.

Would appreciate anyone able to help as its left me very puzzled!

This looks like an application is using that directory as a location for storing cached items. Typically you'll see this type of directory structure when caching files on a filesystem. It helps to optimize performance when read/writing the files to the filesystem and standardizes the interaction for the application that's doing it. Hence the regularity to the naming structure.

You could try analyzing what files all your applications have open to see if you can identify who the offending application is. To do this type of analysis you can use the UNIX CLI tool called lsof.

$ sudo lsof | grep '/Documents/'

Example

$ sudo lsof | grep '/Documents/'
DiskSpace  6071        joeuser    3r      REG                1,5     106496 11534741 /Users/joeuser/Library/Containers/com.apple.iBooksX/Data/Documents/BKLibrary/BKLibrary-1-091020131601.sqlite
DiskSpace  6071        joeuser    4r      REG                1,5     762232 11534745 /Users/joeuser/Library/Containers/com.apple.iBooksX/Data/Documents/BKLibrary/BKLibrary-1-091020131601.sqlite-wal
DiskSpace  6071        joeuser    5r      REG                1,5      32768 11534746 /Users/joeuser/Library/Containers/com.apple.iBooksX/Data/Documents/BKLibrary/BKLibrary-1-091020131601.sqlite-shm

These items that lsof found aren't offending applications, these simply happened to have the string /Documents/ in their paths. But are still examples of how lsof can identify files that processes have open.

In this made up scenario, the process that's using these files is this process:

$ pgrep -fl DiskSpace
6071 /Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency

So this process, DiskSpace is utilizing files which happen to have /Documents/ in their location on the filesystem.

NOTE: You should be able to adapt this same method to troubleshoot what process is using the /Documents/ on your system.

How to fix it?

If it truly is Safari that's putting these files here then I'd direct my attention to setting pertaining to Safari that dictate where it should be putting its cached files. It's likely that one of these settings has been accidentally changed so that Safari is now writing its cached files into your /Documents/ directory.

Safari typically points to these directories as described in this AD Q&A: Which folder can I find cache files for Safari?.