xattr

Display and manipulate extended attributes

xattr -p [-lrsvx] name file
xattr    [-lrsvx] file
xattr -w [-rsx] name value file
xattr -d [-rsv] name file
xattr -c [-rsv] file

Display, modify or remove the extended attributes of file system objects.
Extended attributes are arbitrary metadata (such as lastuseddate) stored separately from the basic filesystem attributes (such as modification time or file size).

These are indicated by ls with an @, for example:

ls -l
total 34028
-rw-r--r--   1 duser  staff       688 Mar 19 12:08 0
-rw-r--r--@  1 duser  staff      4134 Mar 19 08:57 CHANGELOG.md
-rw-r--r--@  1 duser  staff      2134 Mar 19 08:57 library.lst
drwxr-xr-x@ 32 duser  staff      1024 Mar 19 08:57 src/ 

> ls -l@ library.lst     
    com.apple.lastuseddate#PS    16           #display  with name and length of the value.    

> xattr -l library.lst
com.apple.quarantine: 0082;6054cb0e;Safari;

Examples are edited for clarity.

-l long format, both names and values are displayed.
Use -x for hexadecimal display
> xattr -lx ruuvitag_b.ld.orig 
com.apple.lastuseddate#PS: 00  3D 6A 45 60 00 00 00 00 53 20 D4 38 00 00 00 00  
com.apple.quarantine: 0083;605cdc3b;Safari;68E96022-E6D0-450E-9EF3-0E7E699AF83F
-p [-lrsvx] name file print the value for name
Displayed as strings, unless nulls are in the data or with -x then they are displayed in hexadecimal.
> ls -l track*
-rw-r--r--  1 uusser  staff   126 Jun 12  2011 trackPad.mak
-rw-r--r--@ 1 uusser  staff  1490 Sep 16  2011 trackpad.c
           indicates xattr exists

> xattr -p  com.apple.TextEncoding trackpad.c 
utf-8;134217984         134217984 = x'8000100'

> xattr -p -l com.apple.TextEncoding trackpad.c 
com.apple.TextEncoding: utf-8;134217984

 > xattr -p -lx  com.apple.TextEncoding trackpad.c 
com.apple.TextEncoding:
00000000  75 74 66 2D 38 3B 31 33 34 32 31 37 39 38 34     |utf-8;134217984| 
without an operation, displays name only
> xattr trackpad.c 
com.apple.TextEncoding
-w [-rsx] name value file write name and value.
value :a string or with -x hexadecimal (whitespace ignored)
The xxd utility can be used to display hex.
echo $'\a12\bAB' |xxd
00000000: 0731 3208 4142 0a                        .12.AB.
.
-d [-rsv] name file delete name ( and value)
-c [-rsv] file clear all.
Options:
-r recursively process directories
-s symbolic link itself is acted on.
-v verbosely display file name ( with only one file the name is otherwise supressed)
-x display in hexadecimal
‑‑help
-h
 

value is often a null-terminated UTF-8 string, but can be arbitrary binary data.

Exit status

On error, non-zero is returned, and an error message is output to standard error.

HOWEVER, no message is displayed and then return code is 0 if the file does not exist!

For system call errors, both the error code and error string are output

No such file: file with a return status of 1 is reported for symbolic links if -s is not supplied!

[Errno 32] Broken pipe might be reported if xattr is piped to head

ENOATTR No extended attribute
EEXIST named attribute exists with XATTR_CREATE
ENOATTR no attribute with XATTR_REPLACE
EACCES Access denied for search for a component of path or permission is denied to read attributes from .
EROFS Read Only File System
EINVAL invalid name or options has an unsupported bit set.
EISDIR Is a Directory but the attribute in question is only applicable to files. Similar to EPERM.
ELOOP Looping symbolic links
EFAULT path points to an invalid address.
ENOTSUP NOT Supported by the file system or xattr is disabled.
ENOTDIR NOT a DIRectory
ENAMETOOLONG name exceeds XATTR_MAXNAMELEN UTF-8 bytes, or
a component of path exceeds NAME_MAX characters, or
the entire path exceeds PATH_MAX characters.
ERANGE namebuf (as indicated by size) is too small to hold the list of names.
EPERM path or fd refer to a file system object that does not support extended attributes. For example, resource forks don't support extended attributes.
EIO I/O error occurred.
EINVAL INVAiLd options
E2BIG size of the extended attribute is too large.
ENOSPC Not enough SPaCe left on the file system.

Dates

Dates may be stored as CFDate let date = NSMetadataItem(url: url)!.value(forAttribute: NSMetadataItemLastUsedDateKey) as! Date
print(date, date.timeIntervalSinceReferenceDate)

size

Some attribute data may have a fixed length that is enforced by the system. For example,

> xattr -w com.apple.FinderInfo 0 foo
xattr: [Errno 34] Result too large: 'foo' 
The com.apple.FinderInfo attribute must be 32 bytes in length.

Warning:

EXAMPLES

  • Downloaded jar file:
    "file.jar" can't be opened because it is from an unidentified developer.
    Your securty preferences allow installation of only apps from the App Store and identified developers.
    browser downloaded this file xxx at hh:mm from
    domain
    ls -l@ CSVFixer.jar 
    -rw-r--r--@ 1 duser  staff  3663 Jan 15 16:06 CSVFixer.jar
        com.apple.lastuseddate#PS     16 
        com.apple.metadata:kMDItemDownloadedDate      53 
        com.apple.metadata:kMDItemWhereFroms      97 
        com.apple.quarantine      57 

  • Copy the com.apple.FinderInfo attribute to the MyDir from the /usr directory
    >xattr -px com.apple.FinderInfo /usr
    00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    > xattr -l MyDir
    > xattr -wx com.apple.FinderInfo \
    "`xattr -px com.apple.FinderInfo /usr`" MyDir
    > xattr -l MyDir
    com.apple.FinderInfo:
    
    000  00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00  |........@.......|
    010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
    020 
    list then Clear xattributes
    > xattr -l *
    Makefile: com.apple.quarantine: 0000;4fd141a7;Firefox.app;|org.mozilla.firefox
    cmds.c: com.apple.quarantine: 0000;4fd141f3;Firefox.app;|org.mozilla.firefox
    
    > xattr -c *
    
    /Volumes/biggies/.MobileBackups/Computer/2016-02-15-013729/Volume > > xattr -l realger1_birding-2.sql.gz com.apple.backupdelta.deletionMarkerAndFile: yes com.apple.backupdelta.inodeForDeletioniOriginal: 1657554 com.apple.metadata:kMDItemDownloadedDate: 000 62 70 6C 69 73 74 30 30 A1 01 33 41 BA A1 09 3E |bplist00..3A...>| 010 A2 AE 19 08 0A 00 00 00 00 00 00 01 01 00 00 00 |................| 020 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 |................| 030 00 00 00 00 13 |.....| com.apple.metadata:kMDItemWhereFroms: rearranged for clarity 000 62 70 6C 69 73 74 30 30 A2 01 02 5F 10 53 68 74 |bplist00..._. 010 74 70 73 3A 2F 2F 72 65 61 6C 2D 77 6F 72 6C 64 | Shttps://real-world-systems.com:2083/ 020 2D 73 79 73 74 65 6D 73 2E 63 6F 6D 3A 32 30 38 | 030 33 2F 63 70 73 65 73 73 33 34 37 35 37 30 39 35 | cpsess3475709574/3rdparty/phpMyAdmin/export.php 040 37 34 2F 33 72 64 70 61 72 74 79 2F 70 68 70 4D | 050 79 41 64 6D 69 6E 2F 65 78 70 6F 72 74 2E 70 68 | 060 70 5F 10 8C 68 74 74 70 73 3A 2F 2F 72 65 61 6C | _.. https://real-world-systems.c|om:2083/ 070 2D 77 6F 72 6C 64 2D 73 79 73 74 65 6D 73 2E 63 | 080 6F 6D 3A 32 30 38 33 2F 63 70 73 65 73 73 33 34 | cpsess3475709574/3rdparty/phpMyAdmin/index.php? 090 37 35 37 30 39 35 37 34 2F 33 72 64 70 61 72 74 | 0A0 79 2F 70 68 70 4D 79 41 64 6D 69 6E 2F 69 6E 64 | 0B0 65 78 2E 70 68 70 3F 74 6F 6B 65 6E 3D 64 32 34 | token=d246abad71da5e23a960eb325feaad6d 0C0 36 61 62 61 64 37 31 64 61 35 65 32 33 61 39 36 | 0D0 30 65 62 33 32 35 66 65 61 61 64 36 64 26 64 62 | 0E0 3D 72 65 61 6C 67 65 72 31 5F 6D 6F 6F 64 6C 65 | &db=realger1_moodle 0F0 08 0B 61 00 00 00 00 00 00 01 01 00 00 00 00 00 |..a.............| 100 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 110 00 00 F0 |...| com.apple.quarantine: 0042;54f0d1be;Safari.app;87B13B67-43A5-4AF1-80E1-C48D90FFB53D xattr -l DaveDennisPepperMaggieAbbieJune2014.jpg: com.apple.quarantine: 0042;54f903a0;Preview; xattr -l eicar # anti-virus test file uk.co.canimaansoftware.clamxav.infection-state: infected uk.co.markallan.clamxav.infection-state: infected xattr -l track* trackpad.c: com.apple.TextEncoding: utf-8;134217984 .. (parent directory) com.apple.progress.fractionCompleted 11 Desktop/DGGinfo.gif: com.apple.metadata:kMDItemScreenCaptureType: 000 62 70 6C 69 73 74 30 30 57 64 69 73 70 6C 61 79 |bplist00Wdisplay| 010 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 00 |................| 020 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 030 10 |.| 031 eatz.txt: com.apple.TextEncoding: macintosh;0 folderTree0: com.apple.quarantine: 0001;51deed09;Thunderbird.app; roombaBrushes.jpg: com.apple.quarantine: 0042;50f843a8;Preview; Documents/1984.txt.html: com.apple.metadata:kMDItemWhereFroms: 000 62 70 6C 69 73 74 30 30 A1 01 5F 10 2C 68 74 74 |bplist00.._.,htt| 010 70 3A 2F 2F 67 75 74 65 6E 62 65 72 67 2E 6E 65 |p://gutenberg.ne| 020 74 2E 61 75 2F 65 62 6F 6F 6B 73 30 31 2F 30 31 |t.au/ebooks01/01| 030 30 30 30 32 31 2E 74 78 74 08 0A 00 00 00 00 00 |00021.txt.......| 040 00 01 01 00 00 00 00 00 00 00 02 00 00 00 00 00 |................| 050 00 00 00 00 00 00 00 00 00 00 39 |..........9| 05b Documents/1984.txt.html: com.apple.quarantine: 0000;55859397;Safari.app; Documents/3D+printerComparion.html: com.apple.metadata:kMDItemDownloadedDate: 000 62 70 6C 69 73 74 30 30 A1 01 33 41 B9 6C A5 84 |bplist00..3A.l..| 010 12 C9 C1 08 0A 00 00 00 00 00 00 01 01 00 00 00 |................| 020 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 |................| 030 00 00 00 00 13 |.....| 035 com.apple.metadata:kMDItemWhereFroms: 000 62 70 6C 69 73 74 30 30 A1 01 5F 10 34 68 74 74 |bplist00.._.4htt| 010 70 3A 2F 2F 77 77 77 2E 6D 61 6B 65 72 73 68 65 |p://www.makershe| 020 64 2E 63 6F 6D 2F 70 61 67 65 73 2F 33 64 2D 70 |d.com/pages/3d-p| 030 72 69 6E 74 65 72 2D 63 6F 6D 70 61 72 69 73 6F |rinter-compariso| 040 6E 08 0A 00 00 00 00 00 00 01 01 00 00 00 00 00 |n...............| 050 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 060 00 00 41 |..A| com.apple.quarantine: 0000;53bc6e03;Safari.app; 063 xattr -l "Documents alias" com.apple.FinderInfo: 000 66 64 72 70 4D 41 43 53 84 00 00 00 00 00 00 00 |fdrpMACS........| 010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 020 com.apple.ResourceFork: 000 00 00 01 00 00 37 B0 C8 00 37 AF C8 00 00 00 52 |.....7...7.....R| … 190 00 00 00 00 00 00 00 00 00 00 00 00 00 07 64 67 |..............dg| 1A0 65 72 6D 61 6E 00 00 10 00 08 00 00 C8 F7 9B 85 |erman...........| 1B0 00 00 00 11 00 08 00 00 C8 DB FA 78 00 00 00 01 |...........x....| 1C0 00 04 00 03 13 B3 00 02 00 17 44 41 54 41 3A 64 |..........DATA:d| 1D0 67 65 72 6D 61 6E 3A 00 44 6F 63 75 6D 65 6E 74 |german:.Document| 1E0 73 00 00 0E 00 14 00 09 00 44 00 6F 00 63 00 75 |s........D.o.c.u| 1F0 00 6D 00 65 00 6E 00 74 00 73 00 0F 00 0A 00 04 |.m.e.n.t.s......| 200 00 44 00 41 00 54 00 41 00 12 00 12 2F 64 67 65 |.D.A.T.A..../dge| 210 72 6D 61 6E 2F 44 6F 63 75 6D 65 6E 74 73 00 13 |rman/Documents..| 220 00 0D 2F 56 6F 6C 75 6D 65 73 2F 44 41 54 41 00 |../Volumes/DATA.| 230 00 15 00 02 00 15 FF FF 00 00 00 1B D7 43 69 63 |.............Cic| 240 6E 73 00 1B D7 43 54 4F 43 20 00 00 00 70 69 73 |ns...CTOC ...pis| 250 33 32 00 00 02 37 73 38 6D 6B 00 00 01 08 69 63 |32...7s8mk....ic|
    additional bytes totaling 17,793,106!
    0037B0E0  00 1C 00 52 00 01 61 6C 69 73 00 00 00 12 69 63  |...R..alis....ic|
    0037B0F0  6E 73 00 01 00 1E 00 00 FF FF 00 00 00 00 00 00  |ns..............|
    0037B100  00 00 BF 90 FF FF 00 00 01 3A 00 00 00 00 BF B9  |.........:......|
    0037B110  FF FF 00 1B D8 81 03 00 00 00                    |..........|
    
    
    
    As of OS X El Captian 10.11
    xattr -l /usr
    com.apple.FinderInfo:
    000  00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00  |........@.......|
    010  00-00
    020
    com.apple.rootless: 
    /usr > sudo xattr -d com.apple.rootless /usr
    Password:
    xattr: [Errno 1] Operation not permitted: '/usr'
    
    
    Some examples:
    com.apple.lastuseddate#PS 16 FFFFFFFFF5B 00 00 00 00 FFF67 52 1E 00 00 00 00
    > xattr -l hex* |hexdump -C
    00  68 65 78 64 75 6d 70 63  63 63 3a 20 63 6f 6d 2e  |hexdumpccc: com.|
    10  61 70 70 6c 65 2e 6c 61  73 74 75 73 65 64 64 61  |apple.lastusedda|
    20  74 65 23 50 53 3a 20 a5  ca 81 5b 0a              |te#PS: ...[.| 
    NSMetadataItemLastUsedDateKey
    Does NOT seem to reflect the last Used Date
    com.apple.quarantine time when a file was quarantined, and
    application that downloaded a file.
    com.apple.quarantine 22,25,26,30,31,34,38,42,46,49,54,57,60,61,70,74,78,85,89 (( "%&0148BFITWptx…‰ )) not text.
    com.apple.quarantine: d002;5786571b;Safari.app;A7173968-A74A-4CF6-A618-781494E1E0FE
    com.apple.lastuseddate#PS example
    Swift:"NSMetadataItem(url: url)?.value(forAttribute: NSMetadataItemLastUsedDateKey) as? Date"
    to date
    com.apple.metadata:kMDItemWhereFroms 100-566 the URL where a file was downloaded from, sometimes also including the chain of URLs that were redirected to that URL.
    com.apple.metadata:kMDItemWhereFroms78,119
    com.apple.metadata:kMDItemDownloadedDate 53 time when a file was downloaded.
    com.apple.metadata:_kMDItemUserTags tags.
    com.apple.metadata:kMDItemFinderComment Spotlight comment, which is usually also stored in a .DS_Store file.
    com.apple.metadata:kMDLabel_jmugefj4ksjcrhaoknys6lqqay 89
    com.apple.metadata:com_apple_backup_excludeItem 61  
    com.apple.decmpfs implement HFS+ compression. It is not shown by xattr.
    com.apple.diskimages.fsck 20 verification status for DMG files.
    com.apple.FinderInfo32 file flags, which are not actually stored as an extended attribute.
    com.apple.progress.fractionCompleted1,4 for a .download bundle.
    com.apple.ResourceFork286 which is not actually stored as an extended attribute.
    com.apple.system.Security implement ACLs. It is not shown by xattr.
    com.apple.TextEncoding 11,15 for a file saved with an application like TextEdit.
    com.apple.ubd.prsid ? Library/Mobile Documents.95670203:
    com.apple.Preview.UIstate.v1 244,252,255,258,262
    /etc/fing_kTimeMachineNewestSnapshot
    _kTimeMachineOldestSnapshot
    ~/Library/Mobile\ Documents com.apple.ubd.prsid: 95670203.CloudDocs
    Prevents finder from opening:
    com.apple.finder.copy.checkpoint#N:
    com.apple.finder.copy.source.inode#N:
    com.apple.finder.copy.source.volumeuuid#N: 209066D7-AAD7-46FB-AC09-7FDADA96A54C
    com.apple.metadata:kMDItemResumableCopy: bplist00_XE9FBC316-5864-50F1-AF43-2DA86A8CA1E2
    sudo xattr /Volumes/* 
    /Volumes/DATA: purgeable-drecs-fixed
    
    /Volumes/dgerman23: com.apple.backupd.BackupMachineAddress
    /Volumes/dgerman23: com.apple.backupd.ComputerName
    /Volumes/dgerman23: com.apple.backupd.HostUUID
    /Volumes/dgerman23: com.apple.backupd.ModelID
    /Volumes/dgerman23: com.apple.timemachine.private.structure.metadata
    
    
    

    Last Used Date

    > xattr -lx 1040History.ods
    com.apple.lastuseddate#PS:
    0000  6C 7A B5 65 00 00 00 00 4D 47 F6 04 00 00 00 00  |lz.e....MG......|
    0010
    com.apple.macl:
    0000  06 00 1A 05 55 18 6F 9C 43 AF B2 5C 1A 1A 27 FC  |....U.o.C..\..'.|
    0010  7D B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |}...............|
    0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
    0030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
    0040  00 00 00 00 00 00 00 00                          |........|
    0048
    
    # print only value of attribute                         convert 4 bytes to 1 word hexadecimal
    > xattr -p 'com.apple.lastuseddate#PS' 1040History.ods |hexdump -n4 -e '  "%08X  \n"'
    65B57A6C
    
    > bc
    >>> obase=10
    >>> ibase=16
    >>> 65B57A6C
    1706392172
    > date -r 1706392172 
    Sat Jan 27 16:49:32 EST 2024
    
    
    > stat 1040History.ods
     size           access        modification         change         Born   
    19852  __-__-__  16:49:18  05/20/16  21:28:11  __-__-__  16:49:32  05/20/16  21:28:11  1040History.ods
    
    
    xattr -l structure.rtf
    com.apple.lastuseddate#PS: 0B A6 28 62
    com.apple.macl: 04 
    com.apple.metadata:_kMDItemUserTags: bplist00  A0 08
    com.apple.metadata:kMDLabel_bkeh75pqu2oky2qhecizymyyyi:  F2 F7 5B F3 …
    % xattr -l structure.rtf |hexdump -C
    090  69 7a 79 6d 79 79 79 69  3a 20 f2 f7 5b f3 4e 42  |izymyyyi: ..[.NB|
    0a0  65 28 b0 e2 bb 1e fd 22  a0 0a ce d2 3b be bf 77  |e(....."....;..w|
    0b0  03 99 c4 01 e4 5e a2 f8  d0 88 35 6c 2a 73 2c 1a  |.....^....5l*s,.|
    0c0  20 b9 51 b4 3d 71 08 db  26 f6 93 bc 03 dd c6 ac  | .Q.=q..&.......|
    0d0  34 7e 6b a3 a2 79 17 0a  e4 2c 05 3d 38 41 aa 51  |4~k..y...,.=8A.Q|
    0e0  d2 5b 62 01 33 43 f4 6c  58 61 1d 28 ab da 56 78  |.[b.3C.lXa.(..Vx|
    0f0  16 b5 e9 0a                                       |....|
    0f4 
    
    com.apple.diskimages.recentcksum 7 ,80,81 NSImageMetadata
    com.apple.diskimages.fsck: CD B4 BF D6 65 3E 83 91 82 4E 6B D3 00 1E 6B 60 B4 26 CE 16
    com.apple.diskimages.recentcksum: i:6200308 on B1CA7351-D631-3AA7-8D0F-B2BC3D7CA2E4 @ 1449099544 - CRC32:$7BA8C2E1

    bug

     xattr -lx i.sh
    com.apple.metadata:kMDLabel_gqfsrsjabcr6qc7jv3ogtzaqpi:
    00000000  FF F25 57 04 FF F45 4A FF F37 10 53 FF  FF FF FF 25  |.%W..EJ.7.S....%|
    0010  FF  7B 5C 19 05 6F FF FF FF FF F3C 03 7E FF FF FF 02  |..{\..o...<.~...|
    0020  FF  36 23 5B FF FF FF FF F58 05 0B FF FF FF FF F49 71  |..6#[...X.....Iq|
    0030  3B FF  FF F53 38 FF F1F FF FF FF FF FF FF 47 FF FF FF 42  |;...S8......G..B|
    0040  FF  FF FF FF 5D FF F00 55 FF FF FF FF F6F 65 FF F5F FF FF FF C5  |....]...........|
    0050  FF  6A 3F FF F5D 69 FF FF FF FF FF FF 34 6A FF F68 FF FF FF A0  |..j?.]i....4j.h.|
    0060  51 74 30 FF F47 FF  59 FF F11 FF F03 FF F74 14 01  |Qt0.G..Y.....t..|
    0070  49 FF F76 FF  12 FF FF FF FF FF FF 64 FF FF FF 48 FF F32  |I.v.......d..H.2|
    0080  05 FF F2E FF  7F 34 FF FF FF FF FF FF 72 6F FF FF FF 38  |......4....ro..8|
    0090  FF F65 0D FF  23 20 1F 6E FF F06 FF FF FF 2F 36 FF FF FF E0  |.e...# .n..../6.|
    00A0  FF F60 43 5E 09 19 09 FF F75 FF  18 5E FF F26 FF FF FF CF  |.`C^....u...^.&.|
    00B0  2D FF F75 79 56 0F FF  6E 24 FF FF FF 04 FF F62 78  |-.uyV...n$....bx|
    00C0  5C 64 02 67 FF F21 FF F39 3C FF  FF FF FF FF F56 FF FF FF B5  |\d.g.!.9<.....V.|
    00D0  5A FF F3E 3F FF  3B FF FF FF 14 FF FF FF 59 FF FF FF FF FF FF F6  |Z.>?..;.....Y...|
    00E0  15 2F 49 FF F35 FF  FF FF FF 35 6B 00 78 1F 79 4F  |./I.5....5k.....|
    00F0  FF F16 FF F03 48 28 10 47 FF  D3                 |....H(.G.|
    00F9
    > xattr -l i.sh
    com.apple.metadata:kMDLabel_gqfsrsjabcr6qc7jv3ogtzaqpi: 
                                                           
    > xattr -l i.sh|hexdump -C
    0000                                                    |com.apple.metada|
    0010                                                    |ta:kMDLabel_gqfs|
    0020                                                    |rsjabcr6qc7jv3og|
    0030                       20  f2 25 57 04 b2 45 4a ad  |tzaqpi: .%W..EJ.|
    0040  37 10 53 ce ee a5 a9 25  ed 88 7b 5c 19 05 6f c8  |7.S....%..{\..o.|
    0050  ce e8 3c 03 7e 98 8e 02  9a c3 36 23 5b f3 b7 96  |..<.~.....6#[...|
    0060  58 05 0b f8 84 de 49 71  3b e6 d0 a2 53 38 99 1f  |X.....Iq;...S8..|
    0070  8a 9d f9 83 47 fe e4 42  cf f0 db 90 5d 8d 0a     |....G..B....]..|
    007f
    
    > xattr -lx com.github.IngmarStein.Monolingual.Helper.plist
    com.apple.metadata:_kTimeMachineNewestSnapshot:
    62 70 6C 69 73 74 30 30 33 42 2D 63 C3 7F        bplist003B
    10     08                   01 01                    
    20     01                                           
    30     11                                          
    com.apple.metadata:_kTimeMachineOldestSnapshot:
    62 70 6C 69 73 74 30 30 33 41 C0 B9 41 92 80     bplist003A
    10     08                   01 01                 
    20     01                                        
    30     11                                       
    
    
    TG Pro Log.csv: com.apple.lastuseddate#PS:
    99 A7 F8 65 00 00 00 00 DD 43 97 1F 00 00 00 00  
    
    xattr /Volumes/DATADG # mounted on smacpro from smac14 purgeable-drecs-fixed: 0x02 apple kMD…

    xattred tools EclecticLight