Regarding the article “A vulnerability in Quick Look allows data to be revealed in encrypted volumes” in which a user asked about the information stored on a USB stick, I am going to detail some data about which folders are hidden in the first level of a Mac formatted USB stick.
First, let’s go to the question in Manuel Bonino’s article: I’m not sure I understand a question: if someone connects a flash drive to my computer, is the Quick Look cache of my computer also stored on that flash drive? Because each time someone gives us a flash drive so that we can copy something from it, they can store all that information about us in it and could access it. If this were the case, it would be extremely serious.
The answer is simple: no, macOS does not save all of your computer’s QuickLook cache on all disks, including a USB stick that you can occasionally connect to your computer.
This leads to the hidden folders you can find on a USB stick or external hard drive that you connect to your Mac. To display these folders, you can run the wide-area keyboard shortcut 1 ⇧⌘. which allows you to view invisible, first-level files on the Mac2.
When executing this keyboard shortcut we can find several invisible folders in the USB memory or external hard disk3:
.fseventsd
.fseventsd is part of the File System Event notification mechanism – when a file changes, the operating system sends a message to any program that matters to it, such as the Spotlight indexing system.
.Spotlight-V100
Spotlight-V100 is where Spotlight saves its index data: when you search Spotlight, you search this index instead of searching all the files directly. This index is stored here, on each disk or volume, to avoid receiving false positives when you are searching and the drive is not connected. It’s also done this way, storing the search database in this location instead of centralizing it on the boot hard drive, because otherwise, it would store Spotlight information from drives we connect occasionally or even that are not ours and would be taking up unnecessary space and delaying searches. When we invoke Spotlight, the searched person navigates through the whole Volumes structure, selects the Spotlight folders and searches against the indexes stored in those, and in each one of the disks.
.Trashes
This folder corresponds to the Trash folder, with one folder for each user.
System Volume Information
This folder has a trap: it does not correspond to macOS but to Windows. In the case of the Mac, you might ask, “How did it appear if you didn’t connect that disk to a Windows PC? If you run Parallels Desktop for Mac, when you connect a disk and share it with the virtual machine, Parallels puts that folder there so that Windows can get along with that disk, even when it is not formatted for Windows and no HFS+ driver is installed in Windows displayed.
DocumentRevisions-V100
In this folder are stored revisions of disk documents, if they are accessible to the technology implemented by Apple in macOS. In some applications, Apple stores information about the steps, you’ve taken to create a document. So, if you want to review an older version and retrieve information, just invoke the revisions and the document will be displayed in an interface much like Time Machine where you can go back in time to retrieve a version of a document or copy and paste information that you deleted from that document. All that information is stored in this folder for each supported document in a supported application.
Related posts:
Microsoft released Windows 10 Build 18267 with improved search indexer mode
How to keep floating Notes on other apps in macOS
Leave a Reply