01Location
- <folder>/.DS_Store
02Questions it answers
- Which item names were recorded for a folder, possibly including items no longer present?
- Did a user add a Finder (Spotlight) comment to a file?
- How was a folder viewed in Finder (icon, list) and where were icons placed?
03Format and versions
| Format | Binary file with a buddy allocator (magic 'Bud1') managing all but the first 36 bytes; records sit in a B-tree. Each record: file name (length + UTF-16BE), 4-character structure ID, 4-character data type (long, shor, bool, blob, type, ustr, comp, dutc). |
|---|---|
| Applies to | Format reverse-engineered by the Mac::Finder::DSStore project; several structure IDs were added in Mac OS X 10.6–10.8. Apple does not publish the format. |
04Key fields
| Field | What it tells you |
|---|---|
| Iloc | 16-byte blob with the icon's position in the folder window. |
| bwsp, lsvp, icvp | Binary property lists with window layout, list-view and icon-view settings (Mac OS X 10.6+). |
| cmmt | Unicode string with the file's Spotlight comment. |
| dscl | Boolean on subdirectories indicating they are open in list view. |
| lg1S / logS, ph1S | Logical and physical size values recorded for directories. |
| moDD / modD | dutc timestamps on directories, typically matching the modification date. |
| pict | Alias record pointing to a folder background image. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| dutc values (e.g. moDD, modD) | int64 count of 1/65536-second units since 1904-01-01 (classic Mac epoch) | Divide by 65536 for seconds since 1904, then subtract 2082844800 for Unix seconds; the source does not state the time zone. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect .DS_Store files together with the folder path they came from.
- Parse the buddy allocator and B-tree and list records by file name and structure ID.
- Compare recorded names with the current folder contents and investigate names without a matching file.
- Extract cmmt comments and dutc dates and place them on the timeline with their uncertainty noted.
07Interpretation pitfalls
- The format is undocumented; meanings of several structure IDs are inferred and some are marked uncertain by the reverse-engineering source.
- A .DS_Store found on removable media, a network share or in an archive may have been written by another Mac.
- Apple documents a DSDontWriteNetworkStores preference that changes .DS_Store handling on SMB shares, so absence on a share is not meaningful by itself.
09Sources
- DSStoreFormat — Mac::Finder::DSStore format notes Wim Lewis, MetaCPAN · checked 2026-10-14
- Adjust SMB browsing behavior in macOS Apple Support · checked 2026-10-14