Jump to content


Photo
- - - - -

.DS_Store Files


  • Please log in to reply
9 replies to this topic

#1 Aghaster

Aghaster

    The Frenchman

  • Agents of the Revolution
  • 2,093 posts
  • Country:
  • Gender:Male
  • Location:Quebec, Canada

Posted 12 April 2009 - 01:56 PM

I've noticed a while ago that MAC OS X creates hidden .DS_Store files that seem to keep information on how to display icons and folders. Sometimes they end up being publicly accessible in a web server, and I was wondering if there was anything valuable to get out of that. Maybe it contains a list of the files of the directory it was taken from? No idea. I'm wondering if there is any program that allows easy reading of the information contained in the file, and also I'd like to know more about what is stored in the file. I guess there isn't much but I just want to make sure. Thanks

#2 R4p1d

R4p1d

    Hakker addict

  • Members
  • 840 posts
  • Country:
  • Gender:Not Telling
  • Location:Space

Posted 12 April 2009 - 02:05 PM

I've noticed a while ago that MAC OS X creates hidden .DS_Store files that seem to keep information on how to display icons and folders. Sometimes they end up being publicly accessible in a web server, and I was wondering if there was anything valuable to get out of that. Maybe it contains a list of the files of the directory it was taken from? No idea. I'm wondering if there is any program that allows easy reading of the information contained in the file, and also I'd like to know more about what is stored in the file. I guess there isn't much but I just want to make sure. Thanks


I've had this in windows xp as well, I don't think it's anything new.

#3 tekio

tekio

    5(R1P7 |<1DD13

  • Binrev Financier
  • 1,102 posts
  • Gender:Male
  • Location:The Blue Nowhere

Posted 12 April 2009 - 02:11 PM

There is an old discolsure vulnerability.

#4 Aghaster

Aghaster

    The Frenchman

  • Agents of the Revolution
  • 2,093 posts
  • Country:
  • Gender:Male
  • Location:Quebec, Canada

Posted 12 April 2009 - 02:45 PM

Okay, so it does contain potentially valuable information. I found this documentation on the the .DS_Store file format, but I'm wondering if anybody knows of a tool to easily read the relevant information out of the file?

#5 chaostic

chaostic

    rekcah-rebÜ

  • Members
  • 724 posts

Posted 12 April 2009 - 07:32 PM

The .Ds_Store is a proprietary binary file format that has been around since atleast system 7. Apple has not disclosed the format, and noone has created a tool that directly mods or reads it.

IT mostly stores the gui info about a folders content and screen location and options.

Interesting, the .DS file in a folder refers to that folders contents, but not that folder itself. The .DS store in the parent folder holds that folders info.

ie: /User/Apple/.DS_store
holds the GUI display boundaries of
/User/Apple/Music
/User/Apple/Pictures
etc.

While the GUI Display boundaries of /User/Apple is stored in
/User/.DS_Store

Also, none of the changes are written to the .ds file until shutdown or safe unmounting of the drive that contains it.

#6 tekio

tekio

    5(R1P7 |<1DD13

  • Binrev Financier
  • 1,102 posts
  • Gender:Male
  • Location:The Blue Nowhere

Posted 16 April 2009 - 04:55 AM

I just learned that looking at the .DS_Store file in a hex editor will display the directory contents..

#7 chaostic

chaostic

    rekcah-rebÜ

  • Members
  • 724 posts

Posted 17 April 2009 - 07:04 PM

I just learned that looking at the .DS_Store file in a hex editor will display the directory contents..


It does. The name of things have two byte letters, one for the letter, then a 00 byte.

#8 Pan

Pan

    Gibson Hacker

  • Members
  • 94 posts
  • Location:Detroit

Posted 19 April 2009 - 12:45 AM

A .DS_Store file will appear in a directory which has been opened in the Finder (or a service that works through the Finder). It would show up in a webserver directory if someone opened that directory locally on the machine, or connected to that directory via AFP (Apple File Protocol) and viewed the mounted share in their Finder. Several aspects of .DS_Store creation can be tweaked by writing defaults. For example...

http://support.apple.com/kb/HT1629

#9 R4p1d

R4p1d

    Hakker addict

  • Members
  • 840 posts
  • Country:
  • Gender:Not Telling
  • Location:Space

Posted 19 April 2009 - 03:36 AM

So what identifiable information is stored within the .DS_Store file?

#10 tekio

tekio

    5(R1P7 |<1DD13

  • Binrev Financier
  • 1,102 posts
  • Gender:Male
  • Location:The Blue Nowhere

Posted 19 April 2009 - 04:30 AM

All files and folders within the directory are disclosed.




BinRev is hosted by the great people at Lunarpages!