Home
Posted By: artie505 Phantom folder? - 04/14/10 07:50 AM
I can't begin to guess why, but when I got my MacBook back from the "Geniuses" I found that the entire root of my HD - Apps, Library, System, Users, and the alias to "User Guides And Information" - had been copied, apparently by drag & drop, to my 2nd partition (which does not have OS X installed on it).

I deleted everything, but one item, System/Library/Caches/com.apple.bootstamps/10C977F3-9B60-34F6-89DB-62AEBBA096FA/(Empty), reappears every time I start up, or restart.

Any body got a clue what it's all about?

Thanks.
Posted By: dkmarsh Re: Phantom folder? - 04/14/10 10:53 AM

Quote:
...the entire root of my HD - Apps, Library, System, Users...

Not sure what you mean here. Only those items, or all of their contents as well (e.g. the entire HD)?

Quote:
...apparently by drag & drop...

What leads you to believe that drag and drop was employed? The reason I ask is that if an OS X installation had been placed on that partition via cloning or restoration from a disk image, and you merely deleted the visible directories, we'd expect there to be invisible files still there. I have no idea if/how these files could generate the /bootstamps directory on startup, but it might be worth taking a look for invisible files in any case.

Googling reveals a number of reports which resemble yours to a greater or lesser degree. This post in Skeletonized, Near Empty Backups Silently Created at Shirt Pocket Discussions has an eery similarity, though the overall circumstances seem a bit different.
Posted By: roger Re: Phantom folder? - 04/14/10 11:50 AM
did you ask the Geniuses?
Posted By: MarkG Re: Phantom folder? - 04/14/10 01:33 PM
I noticed you said you deleted everything from the partition. What happens if you erase the Partition with Disk Utility?
Mark
Posted By: Hal Itosis Re: Phantom folder? - 04/14/10 06:07 PM
Originally Posted By: artie505
I can't begin to guess why, but when I got my MacBook back from the "Geniuses" I found that the entire root of my HD - Apps, Library, System, Users, and the alias to "User Guides And Information" - had been copied, apparently by drag & drop, to my 2nd partition (which does not have OS X installed on it).

I deleted everything, but one item, System/Library/Caches/com.apple.bootstamps/10C977F3-9B60-34F6-89DB-62AEBBA096FA/(Empty), reappears every time I start up, or restart.

Any body got a clue what it's all about?

I don't regard anything as having been fully seen until it's been looked at with Terminal:

ls -alOe /Volumes/"name of your 2nd partition"

also, what do we see in your real caches folder?

ls -alOe /System/Library/Caches

Posted By: artie505 Re: Phantom folder? - 04/15/10 11:16 AM
As soon as I read "invisibles" I realized that you were probably right on the mark, so I checked, found, and deleted, and the "phantom folder" is now history... Duuuh!

What probably happened is whoever worked on my deuced Mac(hina) cloned my HD to my partition to ramp up the temp and fans to either see if my issues could be reproduced, test the newly installed fan, or both. (Strange, though, that I never noticed QuickBoot's drop-down displaying an extra bootable volume.)

> I have no idea if/how these files could generate the /bootstamps directory on startup, [....]

Was that directory really generated? /usr/standalone/i386/Firmware.scap was never present, and I now have two folders in /System/Library/Caches/com.apple.bootstamps, one containing that file, the other empty.
Posted By: artie505 Re: Phantom folder? - 04/15/10 11:28 AM
> I don't regard anything as having been fully seen until it's been looked at with Terminal:

Good point, so I ran your commands, but only after I had already deleted the invisibles...

Code:
Artie-s-Computer-4:~ artie$ ls -alOe /Volumes/HD2
total 1605808
drwxrwxr-x  23 root   admin  -            850 Apr 14 16:51 .
drwxrwxrwt@  5 root   admin  hidden       170 Apr 15 06:52 ..
-rw-rw-r--   1 root   admin  -          12292 Apr 14 16:51 .DS_Store
drwx------   3 root   admin  -            102 Feb 24  2009 .Spotlight-V100
drwxrwxrwt@  3 artie  admin  hidden       102 Apr 14 16:44 .TemporaryItems
d-wx-wx-wt   3 root   artie  -            102 Apr 15 06:52 .Trashes
-rw-r--r--   1 root   artie  -              0 Jan  4 07:56 .com.apple.timemachine.supported
drwx------   9 root   admin  -            306 Apr 15 06:52 .fseventsd
drwxr-xr-x@ 10 artie  artie  -            340 Apr  9 16:48 3rd Party Stuff
drwxr-xr-x  69 artie  admin  -           2346 Jul 23  2009 Beethoven2
drwxr-xr-x   4 artie  admin  -            136 Oct  4  2009 Beethoven3
drwxr-xr-x@ 10 artie  artie  -            340 Mar 15 01:38 Clutter
-rw-r--r--@  1 root   admin  hidden      1024 Feb 10 02:40 Desktop DB
-rw-r--r--@  1 root   admin  hidden         2 Feb 10 02:34 Desktop DF
drwxr-xr-x  17 artie  artie  -            578 Apr 15 06:32 Downloads
-rw-r--r--   1 artie  admin  -      822146518 Apr  7 18:06 MacOSXUpdCombo10.6.3.dmg
drwxr-xr-x  13 artie  admin  -            442 Dec 23 03:06 Tom Lehrer
drwxrwxrwx@ 29 artie  admin  -            986 Apr 10 05:11 iPhoto Library
drwxr-xr-x  11 artie  artie  -            374 Apr 15 06:51 iTunes
drwxr-xr-x  10 artie  admin  -            340 Jan  4 04:28 iTunes 2
drwxr-xr-x@  8 artie  artie  -            272 Jan 21 07:38 kBase
Artie-s-Computer-4:~ artie$

I think all of that should still be there, but I wonder why some of the invisible stuff is not "hidden?"

and

Code:
Artie-s-Computer-4:~ artie$ ls -alOe /System/Library/Caches
total 488
drwxr-xr-x  11 root  wheel  -    374 Apr  4 11:54 .
drwxr-xr-x  63 root  wheel  -   2142 Apr  4 13:59 ..
-rw-r--r--   1 root  wheel  -  21306 Jan  4 08:39 com.apple.Components2.SystemCache.Components
-rw-r--r--   1 root  wheel  -  61882 Jan  5 07:47 com.apple.Components2.SystemCache.QuickTimeComponents
-rw-r--r--   1 root  wheel  -  11756 Apr  4 11:54 com.apple.IntlDataCache.le
-rw-r--r--   1 root  wheel  - 100788 Apr  4 11:54 com.apple.IntlDataCache.le.kbdx
-rw-r--r--   1 root  wheel  -  19336 Apr  4 11:54 com.apple.IntlDataCache.le.sbdl
-rw-r--r--   1 root  wheel  -  18532 Apr  4 11:54 com.apple.IntlDataCache.le.tecx
-rw-r--r--   1 root  wheel  -     41 Jan  4 08:09 com.apple.bootefisignature
drwxr-xr-x   4 root  wheel  -    136 Apr  4 13:29 com.apple.bootstamps
drwxr-xr-x   4 root  wheel  -    136 Apr 14 01:37 com.apple.kernelcaches
Artie-s-Computer-4:~ artie$

Posted By: Hal Itosis Re: Phantom folder? - 04/15/10 03:31 PM
Code:
drwxrwxr-x  23 root   admin  -            850 Apr 14 16:51 .
drwxrwxrwt@  5 root   admin  hidden       170 Apr 15 06:52 ..
-rw-rw-r--   1 root   admin  -          12292 Apr 14 16:51 .DS_Store
drwx------   3 root   admin  -            102 Feb 24  2009 .Spotlight-V100
drwxrwxrwt@  3 artie  admin  hidden       102 Apr 14 16:44 .TemporaryItems
d-wx-wx-wt   3 root   artie  -            102 Apr 15 06:52 .Trashes
-rw-r--r--   1 root   artie  -              0 Jan  4 07:56 .com.apple.timemachine.supported
drwx------   9 root   admin  -            306 Apr 15 06:52 .fseventsd
-rw-r--r--@  1 root   admin  hidden      1024 Feb 10 02:40 Desktop DB
-rw-r--r--@  1 root   admin  hidden         2 Feb 10 02:34 Desktop DF
Originally Posted By: artie505
>> I wonder why some of the invisible stuff is not "hidden?"

If i understand the question, there are 2 ways to make Finder not display something...
  • via the old OS9 Finder flag, recently made accesible in Darwin by Leopard (there was no "hidden" in Tiger's Unix listings)

  • via naming the item to start with a period (a "dot" file, pretty standard Unix practice to hide those unless -a or -A is used with ls)
[there is a 3rd way using a plist, but its use appears to have faded... though it probably still works]

So anyway, the part of the list i quoted has the hidden stuff. For some reason, Apple used the belt-and-suspenders approach on the .TemporaryItems folder... by employing **both** a leading dot and the Finder flag. Either one is enough to influence Finder (unless they wanted to be sure some OS9 user wouldn't see it maybe).

I'm not sure though... did that in any way answer your question?
Posted By: artie505 Re: Phantom folder? - 04/16/10 11:05 AM
> I'm not sure though... did that in any way answer your question?

Yes, it did (and many thanks for your clear response), except for one remaining anomalous item, namely...
Code:
5 root   admin  hidden       170 Apr 15 06:52 ..

What is that one all about? (It seems to also employ the belt-and-suspenders approach.)
Posted By: Hal Itosis Re: Phantom folder? - 04/16/10 03:08 PM
Originally Posted By: artie505
except for one remaining anomalous item, namely...
Code:
5 root   admin  hidden       170 Apr 15 06:52 ..

What is that one all about? (It seems to also employ the belt-and-suspenders approach.)

Well yes and no. That is one of the two directory file refs that every folder (in Unix) must contain.

. 
refers to the "current" directory (/Volumes/HD2 in this case), and
..
refers to the "parent" directory (/Volumes in this case)

Yes, Apple has chosen to hide the /Volumes folder via a Finder flag.
No, Apple doesn't apply that same "hidden" flag to every '..' (since the leading dot already does the hiding, from the current folder's perspective).

Actually, we are into a rather mysterious area now, because both . and .. are very special items. Once upon a time (in Unix) they could be inspected directly by uses, using such commands as

cat ..
od -cb ..

and the OS would allow the user to study their contents in the same manner as any "file". But they aren't normal files (although the saying goes: in Unix, everything is a file). They are really part of the directory structure of the filesystem itself. I sorta understand how it all "works" in the end -- but not all of the underlying implementation details. Plenty of mysteries left to solve. wink

Believe it or not, i have never used that AppleShowAllFiles trick in Terminal to tweak Finder's plist... but i suspect that both . and .. remain abstracted totally out of sight, and can only be "accessed" by users in ways which the system specifically permits us to do.

E.g.,

cd ..

will change directory to the current folder's parent, or

ls ../../*.txt

will list text files in the grand-parent folder.

Posted By: dkmarsh Re: Phantom folder? - 04/16/10 04:50 PM

Quote:
Believe it or not, i have never used that AppleShowAllFiles trick in Terminal to tweak Finder's plist... but i suspect that both . and .. remain abstracted totally out of sight...

You are correct, sir.
Posted By: Hal Itosis Re: Phantom folder? - 04/16/10 06:15 PM
I wonder if they are even "physically" part of each directory (i.e., existing as discrete files, which i believe they did in Unix 1.0), or... if maybe they're more like mechanisms (for lack of a better word) which are made available to every directory, via its inode perhaps. [?? idunno -- i hoped maybe Sanchez mentioned '..' but it doesn't seem so.]

--

But another weird thing (i recall ganbustein and i encountered over at macosxhints some time ago): whether we use a regular program like TextEdit or do it on the command line with Terminal, files starting with a *double* dot are NOT hidden.

touch '..a-hidden-file?'

or save a file with TextEdit named "..textfile.txt"

It turns out visible. confused

No more questions please. grin
Posted By: artie505 Re: Phantom folder? - 04/17/10 05:48 AM
Originally Posted By: Hal Itosis
No more questions please. grin

OK. smile

(Thanks for the fascinating answers; the more I learn about UNIX, the less I know about UNIX.)
© FineTunedMac