How to View & Remove Extended Attributes from a File on Mac OS
Extended Attributes are metadata components that can be unique to specific files and file types on Mac OS. Those extended attributes can be anything from identifying data about the file itself, to quarantine information, origin data, label information, amongst other types of metadata.
Sometimes, advanced Mac users may review extended attributes for a file, or even wish to remove extended attributes from a file or directory for a variety of reasons, and either of those tasks can be accomplished through the command line with the bundled xattr tool in Mac OS. This tutorial will walk through how to both view and remove extended attributes from a file on a Mac.
This is an advanced topic that is really only relevant to advanced users who are already familiar with extended attributes and have a particular reason to want to remove them from a file. If you’re not sure what extended attributes are, why they may (or may not) matter, or why you might want to (or not want to) remove them, this is not for you.
How to View Extended Attributes of a File in Mac OS
The xattr command has been around in Mac OS and Mac OS X for a long time and thus this should work the same on virtually all vaguely modern versions of system software:
- Open the Terminal app, found in /Applications/Utilities/
- Use the xattr command like so, pointing at the file path to inspect extended attributes for
- Hit Return to view the extended attributes for the file specified
xattr ~/Desktop/samplefile.jpg
For example, you might see something like the following after executing the command:
xattr ~/Desktop/samplefile.jpg
com.apple.metadata:kMDItemIsScreenCapture
com.apple.metadata:kMDItemScreenCaptureGlobalRect
com.apple.metadata:kMDItemScreenCaptureType
com.apple.metadata:kMDItemWhereFroms
com.apple.quarantine
In this case you’ll see metadata information that can be used by Spotlight and the Finder search features, as well as quarantine data which may be tied to data downloaded from the web, or brought onto the Mac through a third party app or source. And yes, that is the same quarantine data from that tells you whether or not you see the app “can’t be opened because it is from an unidentified developer” Gatekeeper message when opening certain applications or files – that’s a commonly encountered practical example of an extended attribute.
How to Remove Extended Attributes from a File on Mac
Still in the Terminal app? If not, relaunch Terminal application to begin:
- Find the extended attribute you want to remove from the file using the previous step, in this example let’s assume it’s “kMDItemIsScreenCapture”
- Use xattr with the -d flag on the file like so:
- Hit Return to strip the defined extended attribute from the file as specified by the path
xattr -d com.apple.metadata:kMDItemIsScreenCapture ~/Desktop/samplefile.jpg
In this example, removing “com.apple.metadata:kMDItemIsScreenCapture” from the samplefile.jpg file strips out the screenshot identifier, which you may recognize from this tip for finding and showing all screen shot files on a Mac, which relies on that extended attribute attached to screenshot files in order to locate them. By removing that extended attribute, the file would no longer show up in such a search. Note that using a tool like ImageOptim to strip EXIF metadata from images and pictures does not also remove extended attribute metadata from the images, it only removes the EXIF data – the two are separate.
You can use the xattr tool to view and remove extended attributes on files, directories, and symbolic links this way, and you can use wildcards to apply the extended attribute removal to multiple files as needed.
This is really not something that should be of relevance to most casual Mac users, but for advanced Mac users, tinkerers, developers, sysadmins, information security workers, and many others, being able to view or modify extended attributes can be helpful for particular reasons.
No such xattr: com.apple.metadata:kMDItemIsScreenCapture
I get this when I use the command as suggested
If I try the mdls command with really any file, I just get this (for example):
/Users/xxx/Users/xxx/Downloads/xxx.pdf: could not find /Users/xxx/Users/xxx/Downloads/xxx.pdf.
What can I do? I have tried it with several files and it never works.
Also, is it the same command for folders as well?
Thank you in advance!
I have searched for DAYS on this and can’t find a solution. Hoping someone can help. I am not too technical, rarely use Terminal.
I have an .mp4 file with lots of data (visible with mdls command) which I want to REMOVE. I want to clear ALL metadata, if that were possible.
I can not find any command for deleting metadata. All I can find is conversations about extended attributes, which are not the same thing at all as the xattr command produces totally different info compared to mdls command.
For instance, I have an mp4 file which has a “wherefrom” metadata field which gives the site I used to transfer it from one machine to another. I like my privacy, so I want to clear this. Is it even possible to do so? It would appear not, which I find incredible, but hoping I am wrong :(
Thanks
The `mdls`command shows comprehensive metadata for a file. Some of it is just taken from the normal file data, like dates or its mime type. The additional information you want to remove and is also displayed by `mdls` is in fact saved in extended attributes. You can remove each and every extentended attribute with `xattr -c filename`. If you do this to your file, you will find that the offending information is also gone from the `mdls`listing. But beware to do this to special files like Finder aliases. It will render them inoperable. It will also remove things like labels or custom icons from a file, as all these are saved in extended attributes.
Hi,
I have been having the same problem as you and cannot find any solution during my 3 days search.
I am not too technical either.
The solution suggested by “Bachsau” doesn’t help me, here is why:
1. I have an image file.
2. mdls of my image file returns the following:
…
kMDItemContentCreationDate
kMDItemContentModificationDate
…
kMDItemFSContentChangeDate
kMDItemFSCreationDate
…
and many many many many more
3. xattr of my image file ONLY returns the following:
com.apple.metadata:kMDItemWhereFroms
and NOTHING else
I tried to delete this attribute with -d and -c and it works perfectly but my problem is that I cannot change/see any of the other attributes I have listed above in 2.
4. Here is my question: ” Is there any way that I can change/edit/delete/remove any of the attributes I listed in 2?”
Thanks in advance
Just use the exif utility to remove metadata from an kind of jpg or mp4 file.
Can someone show me how to create a finder smart search for files that have been airdropped onto my macbook?
I found that entering “ls -l@ [file path of airdropped file]” returns:
-rw-r–r–@ 1 pschorn staff 2462001 Nov 25 12:59 /Users/pschorn/Airdrop/IMG_1121.jpg
com.apple.quarantine 59
Also, I wonder wondering how and where are they stored logically and physically. Are they in the inode of the file, part of the file’s data, or stored in some other way. Is there any other way to get to this data than this clumsy command?
These extended attributes are not very well known or explained. Are some of these the data we see when we right-click-get_info in the Finder?
I see a place for comments; or with images things like the type of coding, or dimensions.
Are these all extended attributes, and where are they defined? Are there fixed attributes or can we make our own up? And how does Spotlight interact with this information.
There is so much power here, yet I’ve never run across anything that helps me as a Max owner and user leverage that value?
Thanks for this particular tip (and all others too). Having been a former Windows user and quite informed about file attributes I have at times wondered about Mac OS files and attributes. Did they use them?
Thank you osxdaily team,
RegB