._whatever |
These files are created on volumes that don't natively support full HFS file characteristics (e.g. ufs volumes,Windows fileshares, etc). When a Mac file is copied to such a volume, its data fork is stored under the file's regular name, and the additional HFS information (resource fork, type creator codes, etc) is stored in a second file (in AppleDouble format), with a name that starts with "._". (These files are, of course, invisible as far as OS-X is concerned, but not to other OS's; this can sometimes be annoying...) |
.DS_Store
|
This file in created by the Finder to keep track of folder view options, icon positions, and other visual information about folders. A separate .DS_Store file is created in each directory to store information about that directory, so you'll find them appearing all over the directory tree, in pretty much every folder you've visited with the OS X Finder. |
~/.Trash |
Used to store files folders from the boot volume that a particular user has thrown in the trash, but that haven't been erased yet. |
/.Spotlight-V100 |
Used to store metadata indexes and indexing rules for Spotlight (version 1.00 apparently). Only created under Mac OS X 10.4. |
/Volumes/(whatever)/.Trashes |
On volumes other than the boot volume, a .Trashes folder is used to hold files folders that've been put in the trash but not yet deleted. Since each user has their own personal trash can, subfolders are created under .Trashes for different users, named according to their user ID number. For example, if user #501 throws something on a volume named "Data" into the trash, it'd be moved to a directory named /Volumes/Data/.Trashes/501/. Permissions on this folder are set so that you can only access a trash can if you can guess the users' ID -- that is, you cannot view a list of which users actually have trash cans in existance. If you're trying to free disk space, this can make it rather tricky to find delete the files in other users' trash cans... |
/.hidden |
This contains a list of files for the Finder to hide -- it's one of three ways a file can be made invisible in OS X. This file is semi-obsolete -- i.e. it does not exist in a standard installation of Mac OS X 10.4, but the Finder will still respect it if it exists... |
/.hotfiles.btree |
Used to track commonly-used small files so their position on disk can be optimized (a process called “adaptive hot file clustering”). |
/.vol |
This pseudo-directory is used to access files by their ID number (aka inode number) rather than by name. For example, /.vol/234881034/105486 is file #105486 on volume #234881034. |
/automount |
Used to handle "quasi-static" mounts of network volumes under OS X 10.1. Under most unixes, if a network volume is statically mounted on a client, it's mounted somewhere in the file system, so it looks shows up like a normal directory. Under OS X 10.1, a statically-mounted network volume will actually be mounted in /automount, and a symbolic link pointing to it will be placed where the volume would normally be mounted, thus emulating the normal result. (Compare this with how "network" mounts are handled via/private/Network.) |
/bin |
This is one of several places where unix-style binaries (that is, programs, or command-line commands) are kept. The programs in /bin include the more common and fundamental things that are used from the unix command line (e.g. ls and rm), as well as several shells (the programs that provide the command line itself). The other places where similar files are stored are /sbin, /usr/bin, /usr/sbin, and possibly /usr/local/bin, /usr/local/sbin, and maybe even ~/bin/powerpc-apple-macos; collectively, these can be thought of as the command line's equivalent of /Applications. |
/cores |
(This is actually stored in /private/cores; /cores is really just a symbolic link.) Under some conditions, when a program crashes, it'll "dump core" (essentially, store a copy of the program state at the time it crashed) into this directory. This is really only useful for programmers trying to debug their own programs. |
/dev |
This directory contains what're technically known as device special files. These are not really files in the usual sense, they're more like placeholders that the system uses to keep track of the devices (disks, keyboards, monitors, network connections, etc) attached to it. |
/etc |
(This is actually stored in /private/etc; /etc is really just a symbolic link.) On a typical unix system the /etc folder will contain all the configuration files for a system, including both documents specifying config information as well as scripts for actually performing various configuration tasks. On OS X, some of the config information stored here is overridden by NetInfo or other directory services, but the /etc files still exist. |
/lost+found |
If Disk Utility or fsck discover "orphaned" files (i.e. files that exist, but aren't actually in any directory), they'll be placed here. |
/Network |
This is the "real" location of the Network item that appears at the Computer level in the finder. It provides a place to attach network-wide resources and server volumes. Under OS X 10.1, network resources actually tend to get mounted in /private/Network, and symbolic links to them created in /Network. In OS 10.3, various network resources (mainly servers) appear dynamically in /Network (thanks to some virtual filesystem magic). |
/mach /mach.sym /mach_kernel |
The Mach kernel (which runs at the very core of Mac OS X), along with a couple of shortcuts for getting at it in various ways. |
/private |
In OS X certain root level directories are actually symbolic links (similar to aliases) to directories in /private. Examples are /cores, /etc, and /var which are respectively linked to /private/cores, /private/etc, and /private/var. /private also contains a directory of drivers for certain peripherals. |
/private/Network |
Used to handle "network" (non-static) mounts of network volumes under OS X 10.1. Under previous versions, network mounts were mounted in /Network, but in 10.1 they're actually mounted in /private/network, and a symbolic link is placed in /Network pointing to the actual mount point. (Compare this with how "quasi-static" mounts are handled via /automount.) |
/sbin |
The /sbin directory is like /bin except it contains binaries that are specifically used for system administration (e.g.mount and fsck). |
/tmp |
(This is actually stored in /private/tmp; /tmp is really just a symbolic link.) Programs that need temporary space on the hard disk are usally set up to writetemporary files to the /tmp directory (although some use /var/tmp instead). |
/usr |
The /usr directory contains many subdirectories that have binaries and files specifically of use to the normal (unix) user. |
/usr/bin |
Another place where unix binaries are kept. |
/usr/lib |
Libraries available for use by progrmming on Mac OS X. Unless you install the Developer Tools, this'll be mostly empty. Note that this has no relation to Mac OS X's various "Library" directories." |
/usr/libexec |
Holds various daemon programs, system maintenance scripts, and other unix-style programs that usually aren't run directly by humans. |
/usr/local |
As in most unixes, this directory is used to store local customizations and additions to the standard OS installation (e.g. /usr/local/bin would be likely to hold unix binaries added by the system administrator). This directory can be thought of roughly as the unix equivalent of Mac OS X's local library. In the standard install of Mac OS X it is (not surprisingly) completely empty. Note: As of OS X 10.2, these directories are no longer in the default search path for command-line executables; as a result, anything installed here will not be useable without taking extra steps of one sort or another. |
/usr/sbin |
Yet another place where unix binaries are kept. |
/usr/share |
Contains various data and text files that can, in principle, be shared by multiple architectures (a distinction which makes a lot more sense under other flavors of unix than it does under Mac OS X). |
/usr/standalone |
Contains boot loader programs for (potentially) various computer architectures. In the installs I've looked at, this is simply a duplicate of theBootX loader (also found in /System/Library/CoreServices/BootX); I'm not sure why both copies are needed. |
/var |
(This is actually stored in /private/var; /var is really just a symbolic link.) Sometimes processes controlled by the operating system need a place to storevariable files. Processes like printing and programs that store log files will use subdirectories in the /var directory to store those files. It also holds a fair bit of configuration information (especially in /var/db). |
/var/backups |
Used to store backups of critical system information (mainly, the nightly dumps of NetInfo databases). |
/var/db |
Holds various databases of system information. The most notable are the NetInfo databases (stored in /var/db/netinfo), shadow password files (in /var/db/shadow/hash), and the system's network configuration database (/var/db/SystemConfiguration/preferences.xml - although it moved to /Library/Preferences/SystemConfiguration/ in 10.3), which together store much of the system and network configuration information that a traditional unix admin would expect to find in /etc, and a Mac OS 9 admin would expect to find in System Folderreferences. |
/var/log |
This is where many of the system event logs are kept (others are kept in /Library/Logs). |
/var/root |
The root (superuser) account's home directory. Note that this directory will exist even if you haven't enabled the root account. |
/var/run |
Stores various status information about processes (especially daemons) running on the system. |
/var/tmp |
A place for programs to store temporary data, just like /tmp. Some programs use one, some use the other, so Mac OS X provides both. |
/var/vm |
Used to store the swap files for Mac OS X's virtual memory. |
/var/vm/app_profile |
Holds information about various applications' virtual memory useage. |
/Volumes |
The /Volumes directory is the mount point for all of the drives (other than the boot volume) connected to the system. The Finder hides the Volumes directory itself, but displays its contents at the Computer level. |