How to View & Remove Extended Attributes from a File on Mac OS

0
87

Terminal in macOS

Extended Attributes are metadata components that can be unique to specific files and file types on Mac OS. Those extended attributes can be anything from identifying data about the file itself, to quarantine information, origin data, label information, amongst other types of metadata.

Sometimes, advanced Mac users may review extended attributes for a file, or even wish to remove extended attributes from a file or directory for a variety of reasons, and either of those tasks can be accomplished through the command line with the bundled xattr tool in Mac OS. This tutorial will walk through how to both view and remove extended attributes from a file on a Mac.

This is an advanced topic that is really only relevant to advanced users who are already familiar with extended attributes and have a particular reason to want to remove them from a file. If you’re not sure what extended attributes are, why they may (or may not) matter, or why you might want to (or not want to) remove them, this is not for you.

How to View Extended Attributes of a File in Mac OS

The xattr command has been around in Mac OS and Mac OS X for a long time and thus this should work the same on virtually all vaguely modern versions of system software:

  1. Open the Terminal app, found in /Applications/Utilities/
  2. Use the xattr command like so, pointing at the file path to inspect extended attributes for
  3. xattr ~/Desktop/samplefile.jpg

  4. Hit Return to view the extended attributes for the file specified

For example, you might see something like the following after executing the command:

xattr ~/Desktop/samplefile.jpg
com.apple.metadata:kMDItemIsScreenCapture
com.apple.metadata:kMDItemScreenCaptureGlobalRect
com.apple.metadata:kMDItemScreenCaptureType
com.apple.metadata:kMDItemWhereFroms
com.apple.quarantine

In this case you’ll see metadata information that can be used by Spotlight and the Finder search features, as well as quarantine data which may be tied to data downloaded from the web, or brought onto the Mac through a third party app or source. And yes, that is the same quarantine data from that tells you whether or not you see the app “can’t be opened because it is from an unidentified developer” Gatekeeper message when opening certain applications or files – that’s a commonly encountered practical example of an extended attribute.

How to Remove Extended Attributes from a File on Mac

Still in the Terminal app? If not, relaunch Terminal application to begin:

  1. Find the extended attribute you want to remove from the file using the previous step, in this example let’s assume it’s “kMDItemIsScreenCapture”
  2. Use xattr with the -d flag on the file like so:
  3. xattr -d com.apple.metadata:kMDItemIsScreenCapture ~/Desktop/samplefile.jpg

  4. Hit Return to strip the defined extended attribute from the file as specified by the path

In this example, removing “com.apple.metadata:kMDItemIsScreenCapture” from the samplefile.jpg file strips out the screenshot identifier, which you may recognize from this tip for finding and showing all screen shot files on a Mac, which relies on that extended attribute attached to screenshot files in order to locate them. By removing that extended attribute, the file would no longer show up in such a search. Note that using a tool like ImageOptim to strip EXIF metadata from images and pictures does not also remove extended attribute metadata from the images, it only removes the EXIF data – the two are separate.

You can use the xattr tool to view and remove extended attributes on files, directories, and symbolic links this way, and you can use wildcards to apply the extended attribute removal to multiple files as needed.

This is really not something that should be of relevance to most casual Mac users, but for advanced Mac users, tinkerers, developers, sysadmins, information security workers, and many others, being able to view or modify extended attributes can be helpful for particular reasons.

LEAVE A REPLY

Please enter your comment!
Please enter your name here