Using fileXray to Enumerate Orphaned Files

fileXray’s goal is to help you determine “anything” and “everything” about an HFS+ volume.

Someone recently asked if it is possible to locate all orphaned files on a volume. Indeed, it is possible.

HSF+ allows you to unlink a file or a folder while it is busy. Normally, these are permanently removed at unmount time. However, if the volume was not cleanly unmounted, such unlinked-but-not-removed objects can persist. In such cases, when the volume is subsequently mounted in read/write mode, the file system implementation will look for orphans and remove any that are found.

Orphaned objects have the temp prefix in their names and they reside in the HFS+ Private Data folder. You can enumerate orphans and view the space consumed by them as follows. We use the root volume in this example.

First, we determine the Catalog Node ID (CNID) of the HFS+ Private Data Folder.

$ sudo fileXray --list /
...
18    d--------- ---u  root wheel      \x0000\x0000\x0000\x0000HFS+ Private Data/

Next, we use the CNID to list the contents of this special folder and filter by the temp prefix.

$ sudo fileXray --cnid 18 --list | grep temp
CNID      mode       @+SUZ user     group    data     rsrc     name
...
8433559   -rw------- @---  singh    staff    51 KB    0        temp8433559
8433588   -rw-r--r-- @---  singh    staff    54 KB    0        temp8433588
...

Comments are closed.


All contents of this site, unless otherwise noted, are ©1994-2014 Amit Singh. All Rights Reserved.