cometmace

Q: Access to a resource fork from command-line

How do I do a command-line hexdump or grep on the data contained in the resource fork of a file?

Mac OS X (10.6.7)

Posted on Apr 6, 2011 6:34 AM

Close

Q: Access to a resource fork from command-line

  • All replies
  • Helpful answers

  • by Keith Barkley,

    Keith Barkley Keith Barkley Apr 6, 2011 6:40 AM in response to cometmace
    Level 5 (6,407 points)
    Apr 6, 2011 6:40 AM in response to cometmace
    Move the file to a FAT formatted device and examine the ._* file.
  • by cometmace,

    cometmace cometmace Apr 6, 2011 6:44 AM in response to Keith Barkley
    Level 1 (10 points)
    Apr 6, 2011 6:44 AM in response to Keith Barkley
    Thanks. I'm doing that short term. But that won't scale well for me.
  • by Keith Barkley,

    Keith Barkley Keith Barkley Apr 6, 2011 7:05 AM in response to cometmace
    Level 5 (6,407 points)
    Apr 6, 2011 7:05 AM in response to cometmace
  • by BobHarris,Solvedanswer

    BobHarris BobHarris Apr 6, 2011 7:15 AM in response to cometmace
    Level 6 (19,553 points)
    Mac OS X
    Apr 6, 2011 7:15 AM in response to cometmace
    If the file is named Fred, then you can access the resource fork using

    ls -l Fred/rsrc

    If you need to process a bunch of files you can not use wildcards, but you can use something like:

    for file in /path/to/some/directory/*
    do
    ls -l ${file}/rsrc
    done

    or maybe

    #!/usr/bin/env bash
    find /start/dir -iname "*.jpg" | while read file
    do
    ls -l ${file}/rsrc
    done

    If you need to set shell variables along the way, then

    #!/usr/bin/env bash
    while read file
    do
    ls -l ${file}/rsrc
    done < <(find /start/dir -iname "*.jpg")

    The < space <(...) is called process substitution and is specific to the 'bash' shell, but it allows you to set variables in the 'while' loop. The previous 'find | while' combination would put the 'while' loop in a subprocess and all variable set in that 'while' loop would have been losts as soon as the loop finished.

    Enjoy.
  • by cometmace,

    cometmace cometmace Apr 6, 2011 7:23 AM in response to BobHarris
    Level 1 (10 points)
    Apr 6, 2011 7:23 AM in response to BobHarris
    Wow. This is the brightest light at the end of the tunnel that I've seen so far. I tried it on my machine and definitely got more data displayed than I've seen in the past. This might be the solution. I'll have to experiment a bit.
  • by cometmace,

    cometmace cometmace Apr 6, 2011 7:24 AM in response to Keith Barkley
    Level 1 (10 points)
    Apr 6, 2011 7:24 AM in response to Keith Barkley
    I'm looking at the docs. I'll have to pour over it and run some experiments. I'm not seeing a solution to my problem (yet). It seems as if Rez creates a resource file instead of exposing the contents. Still checking...
  • by Keith Barkley,Helpful

    Keith Barkley Keith Barkley Apr 6, 2011 8:05 AM in response to cometmace
    Level 5 (6,407 points)
    Apr 6, 2011 8:05 AM in response to cometmace
    Check out Derez - which is the analog of Rez.
  • by cometmace,

    cometmace cometmace Apr 6, 2011 8:14 AM in response to Keith Barkley
    Level 1 (10 points)
    Apr 6, 2011 8:14 AM in response to Keith Barkley
    Right on. It combines


    cat x.disc/rsrc > temp.txt
    hexdump -C temp.txt


    into a single command line

    Thanks to all contributors.
  • by BobHarris,Helpful

    BobHarris BobHarris Apr 6, 2011 8:24 AM in response to cometmace
    Level 6 (19,553 points)
    Mac OS X
    Apr 6, 2011 8:24 AM in response to cometmace
    Right on. It combines

    cat x.disc/rsrc > temp.txt
    hexdump -C temp.txt

    into a single command line

    What is wrong with:

    hexdump -C x.disc/rsrc

    If you need a temp.txt file, then the cat is useful, but why not just let hexdump access the rsrc fork directly?
  • by Cole Tierney,

    Cole Tierney Cole Tierney Apr 6, 2011 8:26 AM in response to BobHarris
    Level 4 (1,375 points)
    Apr 6, 2011 8:26 AM in response to BobHarris
    Hi Bob,

    I've always used /..namedfork/rsrc. I didn't realize you could use just /rsrc. Are they synonyms of each other or is there a difference?
  • by cometmace,

    cometmace cometmace Apr 6, 2011 10:07 AM in response to BobHarris
    Level 1 (10 points)
    Apr 6, 2011 10:07 AM in response to BobHarris
    Absolutely nothing. Sometimes, we just make things harder on ourselves.
  • by BobHarris,

    BobHarris BobHarris Apr 6, 2011 10:10 AM in response to Cole Tierney
    Level 6 (19,553 points)
    Mac OS X
    Apr 6, 2011 10:10 AM in response to Cole Tierney
    I've always used /..namedfork/rsrc. I didn't realize you could use just /rsrc. Are they synonyms of each other or is there a difference?

    I didn't know about filename/..namedfork/rsrc

    I think your filename/..namedfork/ approach may work for any generic file system "named data stream". File systems are using different named data streams for things like ACL storage, and other extended attributes.

    I just never knew that Mac OS X HFS+ had the notation of filename/..namedfork to allow access to the other named data streams (or as Apple likes to call them forks).

    If I had to guess, the filename/rsrc is historical, and the filename/..namedfork/rsrc is maybe the current generic access method.
  • by unixRus,

    unixRus unixRus Oct 2, 2015 8:36 AM in response to BobHarris
    Level 1 (0 points)
    Oct 2, 2015 8:36 AM in response to BobHarris

    It's a old thread but how about a more direct method:

     

    xattr -l <filename>

    com.apple.ResourceFork:

    00000000  00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 1E  |................|

    00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000080  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    000000A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    000000B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    000000C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    000000D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    000000E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    000000F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

    00000100  00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 1E  |................|

    00000110  00 00 00 00 00 00 00 00 00 1C 00 1E FF FF        |..............|

    0000011e

  • by unixRus,

    unixRus unixRus Oct 2, 2015 9:38 AM in response to unixRus
    Level 1 (0 points)
    Oct 2, 2015 9:38 AM in response to unixRus

    Ignore last post - mixed up with the extended attributes.