There is a file named index.dat, and subfolders named serially from 00 to 0f, a0 to af ... f0 to ff in my `~/Applications` folder, can I delete them?
My User's Application folder does not contain the regular Applications' folders one might expect. Instead it contains an index.dat
file and a lot of sub-folders that are serially numbered (00,01,...,0f,...,9f,...,a0,...,af,...,ff) and contain *.file
files like "00b1bfebc0ceb054d7872956649e40b091ab9341.file".
See following screenshot:
I'm cleaning up my mac and am not sure if I can delete this. I don't know which Application is creating this... filesystem?.
Some files are written even today so, is there a way to find out which Application is writing these files?
Update:
I did the following:
- Deleted the files and folders in question
- Restart Machine
- Log user back in
- Quickly open terminal and run
sudo fs_usage | grep index.dat
- See the file being accessed by the following:
13:10:44 open /Users/lapdog/Applications/index.dat 0.000041 mdworker
13:10:44 getattrlist /Users/lapdog/Applications/index.dat 0.000027 mds
13:11:23 lstat64 Users/lapdog/Applications/index.dat 0.000022 fseventsd
13:11:23 getxattr /Users/lapdog/Applications/index.dat 0.000011 Dock
13:11:23 lstat64 /Users/lapdog/Applications/index.dat 0.000023 fseventsd
13:11:24 fsgetpath /Users/lapdog/Applications/index.dat 0.000021 mds
13:11:24 getattrlist /Users/lapdog/Applications/index.dat 0.000046 mds
13:11:24 listxattr /Users/lapdog/Applications/index.dat 0.000020 mds
13:11:24 getattrlist /Users/lapdog/Applications/index.dat 0.000081 mds
and a lot more of that until it stops. I still don't know if this is being created upon login or restart. I will check with a different user if the files are being created b4 logging in the with my user again.
Like all things, backup your Mac and then delete the files you suspect are bad / need to know when they re-appear. Backups exist so you are free to clear things knowing you can get them back if you find out later some specific program actually needs them where they are.
Examining the files like this you have some clues that often will let you refine what caused them to be there:
- What permissions / ownership is on the files?
- What are the created dates, last modified dates?
- Can you catch it with
lsof
orfs_usage
(both of which are covered here on site pretty well on how to check for what process has a file open and which process reads / modifies / writes to a file) - Open terminal and use the
file
command to actually inspect the contents. Open them in an editor or a great free program like BBEdit to look at them safely. (Typefile
and a space and then drag one or two of the curious file icons into the terminal window and press return)
What’s clear, is it’s not a program that behaves at all like a mac program and puts application files where they belong in user or system libraries. I would focus on things that are cross-platform or open-source as that’s a typical pattern to shard data to directories that are named algorithmically (Apple does this in /private/var/folders) as well - but hides that away from where people expect properly curated files to exist.
You asked about tools to explore persistently installed apps. Some tools include:
KnockKnock: https://objective-see.com/products/knockknock.html
Launch Control: https://www.soma-zone.com/LaunchControl/