Don't let Mail attachments accumulate and waste space

TidBITS Talk
33

I found it. It’s part of each directory’s extended attributes.

The ls -ld command shows that there are extended attributes (the @ following the permissions):

$ ls -ld ~/Library/Containers/com.apple.mail
drwx------@ 6 ...  staff  192 Dec 14 18:38 /Users/.../Library/Containers/com.apple.mail

If I use the -@ option, it will show the names of these attributes:

$ ls -ld@ ~/Library/Containers/com.apple.mail
drwx------@ 6 ...  staff  192 Dec 14 18:38 /Users/.../Library/Containers/com.apple.mail
	com.apple.FinderInfo	 32 
	com.apple.data-container-personality	2528064

The FinderInfo attribute has Finder-specific data (what HFS and HFS+ used to track natively), including the legacy type/creator codes.

Using the xattr command, I was able to dump these attributes (using the head command to only show the start of data, since the data-container-personality attribute is 2.5 MB):

$ xattr -l ~/Library/Containers/com.apple.mail  | head
com.apple.FinderInfo:
00000000  00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020
com.apple.data-container-personality:
00000000  62 70 6C 69 73 74 30 30 D4 01 02 03 04 05 06 3B  |bplist00.......;|
00000010  3C 54 69 63 6F 6E 54 6E 61 6D 65 52 70 69 57 76  |<TiconTnameRpiWv|
00000020  65 72 73 69 6F 6E 4F 12 00 26 90 80 69 63 6E 73  |ersionO..&..icns|
00000030  00 26 90 80 69 63 31 32 00 00 12 2F 89 50 4E 47  |.&..ic12.../.PNG|
00000040  0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00 00 40  |........IHDR...@|
xattr: [Errno 32] Broken pipe

Note the text representation of the start of the data-container-personality attribute: bplist00. This data is a binary-format plist file. This means we can save it to a file. The xattr command can be used to dump binary-format attributes as hex data:

$ xattr -p com.apple.data-container-personality ~/Library/Containers/com.apple.mail > ~/tmp/mail.plist.hex

$ head ~/tmp/mail.plist.hex 
62 70 6C 69 73 74 30 30 D4 01 02 03 04 05 06 3B
3C 54 69 63 6F 6E 54 6E 61 6D 65 52 70 69 57 76
65 72 73 69 6F 6E 4F 12 00 26 90 80 69 63 6E 73
00 26 90 80 69 63 31 32 00 00 12 2F 89 50 4E 47
0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00 00 40
00 00 00 40 08 06 00 00 00 AA 69 71 DE 00 00 00
01 73 52 47 42 00 AE CE 1C E9 00 00 00 44 65 58
49 66 4D 4D 00 2A 00 00 00 08 00 01 87 69 00 04
00 00 00 01 00 00 00 1A 00 00 00 00 00 03 A0 01
00 03 00 00 00 01 00 01 00 00 A0 02 00 04 00 00

To convert this hex data to its binary representation, the xxd command can be used:

$ cd tmp
$ xxd -r -p mail.plist.hex mail.plist
$ ls -l
total 21456
-rw-r--r--  1 ...  staff  2528064 Jan  4 11:13 mail.plist
-rw-r--r--  1 ...  staff  7584192 Jan  4 11:11 mail.plist.hex

And from there, we can dump the contents of the plist using the plutil command:

$ plutil -p mail.plist
{
  "icon" => {length = 2527360, bytes = 0x69636e73 00269080 69633132 0000122f ... 49454e44 ae426082 }
  "name" => {
    "ar" => "البريد"
    "Base" => "Mail"
    "ca" => "Mail"
    "cs" => "Mail"
    "da" => "Mail"
    "de" => "Mail"
    "el" => "Mail"
    "en" => "Mail"
...
    "zh_HK" => "郵件"
    "zh_TW" => "郵件"
  }
  "pi" => {length = 36, bytes = 0x00000000 14030000 08000000 88b152cc ... 14030000 00000000 }
  "version" => 0
}

And here you can see where the Finder is getting its presentation. The “icon” attribute contains the custom folder icon. And the “name” attribute contains the name it is presented with (in a large set of languages, so it will be localized for languages that don’t have Latin alphabets).

I haven’t (yet) looked to see what the “pi” attribute is for

2 Likes