AppleDouble
(→Other links: Updating Forensics Wiki links) |
|||
| (One intermediate revision by one user not shown) | |||
| Line 20: | Line 20: | ||
Sometimes, instead of using a different filename, the header files are put in special subdirectories named ".AppleDouble". | Sometimes, instead of using a different filename, the header files are put in special subdirectories named ".AppleDouble". | ||
| + | |||
| + | The Finder's "Archive as..." functionality puts them in subdirectories named <code>__MACOSX</code>. | ||
== Identification == | == Identification == | ||
| Line 27: | Line 29: | ||
* [http://kaiser-edv.de/documents/AppleSingle_AppleDouble.pdf AppleSingle/AppleDouble Developer’s Note] - Version 2 | * [http://kaiser-edv.de/documents/AppleSingle_AppleDouble.pdf AppleSingle/AppleDouble Developer’s Note] - Version 2 | ||
* [http://kaiser-edv.de/documents/Applesingle_AppleDouble_v1.html AppleSingle and AppleDouble format internals] · [http://kaiser-edv.de/documents/AppleSingle_AppleDouble_v1.pdf PDF] - Version 1 | * [http://kaiser-edv.de/documents/Applesingle_AppleDouble_v1.html AppleSingle and AppleDouble format internals] · [http://kaiser-edv.de/documents/AppleSingle_AppleDouble_v1.pdf PDF] - Version 1 | ||
| − | * [https://archive.org/details/bitsavers_applemacauoolboxMacintoshROMInterface1990_9531329/page/n125 A/UX Toolbox: Macintosh ROM Interface], p. 6-15: AppleSingle and AppleDouble format internals - Version 1 | + | * [https://archive.org/details/bitsavers_applemacauoolboxMacintoshROMInterface1990_9531329/page/n125 A/UX Toolbox: Macintosh ROM Interface], p. 6-15: AppleSingle and AppleDouble format internals - Version 1 ([https://web.archive.org/web/20190427230049/http://users.phg-online.de/tk/netatalk/doc/Apple/v1/ another copy]) |
* RFC 1740 (describes various Mac-specific formats) | * RFC 1740 (describes various Mac-specific formats) | ||
* [https://kazakov.life/2013/10/31/extracting-extended-attributes-from-apple-double-format/ Extracting extended attributes from Apple Double format] | * [https://kazakov.life/2013/10/31/extracting-extended-attributes-from-apple-double-format/ Extracting extended attributes from Apple Double format] | ||
| Line 40: | Line 42: | ||
== Other links == | == Other links == | ||
* [[Wikipedia:AppleSingle and AppleDouble formats|Wikipedia article]] | * [[Wikipedia:AppleSingle and AppleDouble formats|Wikipedia article]] | ||
| − | * [ | + | * [{{ForensicsWikiURL|appledouble_header_file}} Forensics Wiki article] |
* [https://tools.ietf.org/html/draft-newman-macbin-binhex-harmful-00 MacBinary and Binhex 4.0 considered harmful] | * [https://tools.ietf.org/html/draft-newman-macbin-binhex-harmful-00 MacBinary and Binhex 4.0 considered harmful] | ||
* [https://web.archive.org/web/20120602061209/http://support.apple.com/kb/TA20578 Apple KnowledgeBase notes about AppleDouble] (from archive.org) | * [https://web.archive.org/web/20120602061209/http://support.apple.com/kb/TA20578 Apple KnowledgeBase notes about AppleDouble] (from archive.org) | ||
Latest revision as of 13:12, 2 September 2023
AppleDouble is one of the systems used to store the Resource Fork of Macintosh files on filesystems not natively supporting it, something which became necessary when Apple moved to Unix-based operating systems instead of "classic" MacOS. AppleSingle is an alternative format to accomplish the same end, combining all the forks plus a metadata header in one file instead of keeping separate files like AppleDouble. While both AppleSingle and AppleDouble were introduced for use with early Unix-based Apple systems, AppleDouble survived as the main method of storing files with resource forks on OS X systems if a filesystem is used that doesn't directly support such forks.
Contents |
[edit] File naming
The AppleDouble format keeps the data fork of the file in its original format and filename (this is the main file, as used by non-Mac operating systems, and for many file formats, the only one that matters), and creates a second "header" file with the resource fork as well as Finder metadata.
The specification says that the header filename should be prefixed with a "%", or prefixed with "R.", or have a file extension of ".ADF", depending on the filesystem's capabilities.
However, in the OS X era, the convention is to prefix the header filename with "._" (a dot and an underscore).
One of The Unarchiver's options is to use an extension of ".rsrc".
Sometimes, instead of using a different filename, the header files are put in special subdirectories named ".AppleDouble".
The Finder's "Archive as..." functionality puts them in subdirectories named __MACOSX.
[edit] Identification
AppleDouble header files begin with signature bytes (hex) 00 05 16 07.
[edit] Specifications
- AppleSingle/AppleDouble Developer’s Note - Version 2
- AppleSingle and AppleDouble format internals · PDF - Version 1
- A/UX Toolbox: Macintosh ROM Interface, p. 6-15: AppleSingle and AppleDouble format internals - Version 1 (another copy)
- RFC 1740 (describes various Mac-specific formats)
- Extracting extended attributes from Apple Double format
[edit] Metaformat files
- Synalysis grammar file (for Hexinator / Synalize It!; more details)
