AppleDouble
(add details from ForensicsWiki entry) |
|||
| Line 20: | Line 20: | ||
Sometimes, instead of using a different filename, the header files are put in special subdirectories named ".AppleDouble". | Sometimes, instead of using a different filename, the header files are put in special subdirectories named ".AppleDouble". | ||
| + | |||
| + | The Finder's "Archive as..." functionality puts them in subdirectories named <code>__MACOSX</code>. | ||
== Identification == | == Identification == | ||
| Line 27: | Line 29: | ||
* [http://kaiser-edv.de/documents/AppleSingle_AppleDouble.pdf AppleSingle/AppleDouble Developer’s Note] - Version 2 | * [http://kaiser-edv.de/documents/AppleSingle_AppleDouble.pdf AppleSingle/AppleDouble Developer’s Note] - Version 2 | ||
* [http://kaiser-edv.de/documents/Applesingle_AppleDouble_v1.html AppleSingle and AppleDouble format internals] · [http://kaiser-edv.de/documents/AppleSingle_AppleDouble_v1.pdf PDF] - Version 1 | * [http://kaiser-edv.de/documents/Applesingle_AppleDouble_v1.html AppleSingle and AppleDouble format internals] · [http://kaiser-edv.de/documents/AppleSingle_AppleDouble_v1.pdf PDF] - Version 1 | ||
| − | * [https://archive.org/details/bitsavers_applemacauoolboxMacintoshROMInterface1990_9531329/page/n125 A/UX Toolbox: Macintosh ROM Interface], p. 6-15: AppleSingle and AppleDouble format internals - Version 1 | + | * [https://archive.org/details/bitsavers_applemacauoolboxMacintoshROMInterface1990_9531329/page/n125 A/UX Toolbox: Macintosh ROM Interface], p. 6-15: AppleSingle and AppleDouble format internals - Version 1 ([https://web.archive.org/web/20190427230049/http://users.phg-online.de/tk/netatalk/doc/Apple/v1/ another copy]) |
* RFC 1740 (describes various Mac-specific formats) | * RFC 1740 (describes various Mac-specific formats) | ||
* [https://kazakov.life/2013/10/31/extracting-extended-attributes-from-apple-double-format/ Extracting extended attributes from Apple Double format] | * [https://kazakov.life/2013/10/31/extracting-extended-attributes-from-apple-double-format/ Extracting extended attributes from Apple Double format] | ||
| Line 43: | Line 45: | ||
* [https://tools.ietf.org/html/draft-newman-macbin-binhex-harmful-00 MacBinary and Binhex 4.0 considered harmful] | * [https://tools.ietf.org/html/draft-newman-macbin-binhex-harmful-00 MacBinary and Binhex 4.0 considered harmful] | ||
* [https://web.archive.org/web/20120602061209/http://support.apple.com/kb/TA20578 Apple KnowledgeBase notes about AppleDouble] (from archive.org) | * [https://web.archive.org/web/20120602061209/http://support.apple.com/kb/TA20578 Apple KnowledgeBase notes about AppleDouble] (from archive.org) | ||
| + | * [https://web.archive.org/web/20190427230049/http://forensicswiki.org/wiki/AppleDouble_header_file ForensicsWiki entry] | ||
[[Category:Macintosh]] | [[Category:Macintosh]] | ||
[[Category:Filesystem]] | [[Category:Filesystem]] | ||
[[Category:Multi-file formats]] | [[Category:Multi-file formats]] | ||
Revision as of 23:19, 25 October 2020
AppleDouble is one of the systems used to store the Resource Fork of Macintosh files on filesystems not natively supporting it, something which became necessary when Apple moved to Unix-based operating systems instead of "classic" MacOS. AppleSingle is an alternative format to accomplish the same end, combining all the forks plus a metadata header in one file instead of keeping separate files like AppleDouble. While both AppleSingle and AppleDouble were introduced for use with early Unix-based Apple systems, AppleDouble survived as the main method of storing files with resource forks on OS X systems if a filesystem is used that doesn't directly support such forks.
Contents |
File naming
The AppleDouble format keeps the data fork of the file in its original format and filename (this is the main file, as used by non-Mac operating systems, and for many file formats, the only one that matters), and creates a second "header" file with the resource fork as well as Finder metadata.
The specification says that the header filename should be prefixed with a "%", or prefixed with "R.", or have a file extension of ".ADF", depending on the filesystem's capabilities.
However, in the OS X era, the convention is to prefix the header filename with "._" (a dot and an underscore).
One of The Unarchiver's options is to use an extension of ".rsrc".
Sometimes, instead of using a different filename, the header files are put in special subdirectories named ".AppleDouble".
The Finder's "Archive as..." functionality puts them in subdirectories named __MACOSX.
Identification
AppleDouble header files begin with signature bytes (hex) 00 05 16 07.
Specifications
- AppleSingle/AppleDouble Developer’s Note - Version 2
- AppleSingle and AppleDouble format internals · PDF - Version 1
- A/UX Toolbox: Macintosh ROM Interface, p. 6-15: AppleSingle and AppleDouble format internals - Version 1 (another copy)
- RFC 1740 (describes various Mac-specific formats)
- Extracting extended attributes from Apple Double format
Metaformat files
- Synalysis grammar file (for Hexinator / Synalize It!; more details)
