fileXray’s goal is to help you determine “anything” and “everything” about an HFS+ volume.
Someone recently asked if it is possible to locate all orphaned files on a volume. Indeed, it is possible.
HSF+ allows you to unlink a file or a folder while it is busy. Normally, these are permanently removed at unmount time. However, if the volume was not cleanly unmounted, such unlinked-but-not-removed objects can persist. In such cases, when the volume is subsequently mounted in read/write mode, the file system implementation will look for orphans and remove any that are found.
Orphaned objects have the
temp prefix in their names and they reside in the HFS+ Private Data folder. You can enumerate orphans and view the space consumed by them as follows. We use the root volume in this example.
First, we determine the Catalog Node ID (CNID) of the HFS+ Private Data Folder.
$ sudo fileXray --list / ... 18 d--------- ---u root wheel \x0000\x0000\x0000\x0000HFS+ Private Data/
Next, we use the CNID to list the contents of this special folder and filter by the
$ sudo fileXray --cnid 18 --list | grep temp CNID mode @+SUZ user group data rsrc name ... 8433559 -rw------- @--- singh staff 51 KB 0 temp8433559 8433588 -rw-r--r-- @--- singh staff 54 KB 0 temp8433588 ...