- Code: Select all
macbookpro08-centrim:~ gjp22$ ls -@aehl /Volumes/gjp22/Pictures/screen\ captures
total 37520
drwx------ 4 gjp22 wheel 23B 14 Mar 18:15 .
drwx------ 19 gjp22 wheel 36B 8 Mar 19:00 ..
-rw-------@ 1 gjp22 wheel 15K 14 Mar 18:10 .DS_Store
com.apple.FinderInfo 32B
-rw-r--r--@ 1 gjp22 wheel 168K 14 Feb 23:17 2013-02-14 23-17-37 error 102.png
com.apple.metadata:kMDItemScreenCaptureType 48B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 170K 14 Feb 23:32 2013-02-14 23-32-51 error 102.png
com.apple.metadata:kMDItemScreenCaptureType 48B
com.apple.metadata:kMDItemIsScreenCapture 42B
drwxr-xr-x 2 gjp22 wheel 7B 9 Mar 10:24 Java
drwxr-xr-x 3 gjp22 wheel 36B 13 Mar 00:18 VirtualBox
-rw-r--r--@ 1 gjp22 wheel 1.4M 14 Mar 17:57 screenshot 2013-03-14 at 17.54.35 (2).png
com.apple.metadata:kMDItemScreenCaptureType 0B
com.apple.metadata:kMDItemIsScreenCapture 0B
-rw-r--r--@ 1 gjp22 wheel 1.3M 14 Mar 17:57 screenshot 2013-03-14 at 17.54.35.png
com.apple.metadata:kMDItemIsScreenCapture 0B
com.apple.metadata:kMDItemScreenCaptureType 0B
-rw-r--r--@ 1 gjp22 wheel 86K 14 Mar 18:01 screenshot 2013-03-14 at 18.01.25.png
com.apple.FinderInfo 32B
-rw-r--r--@ 1 gjp22 wheel 342K 14 Mar 18:08 screenshot 2013-03-14 at 18.08.14.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemIsScreenCapture 42B
com.apple.metadata:kMDItemScreenCaptureType 48B
-rw-r--r--@ 1 gjp22 wheel 349K 14 Mar 18:08 screenshot 2013-03-14 at 18.08.21.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 48B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 861K 14 Mar 18:09 screenshot 2013-03-14 at 18.09.19.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 48B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 1.3M 14 Mar 18:09 screenshot 2013-03-14 at 18.09.39 (2).png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemIsScreenCapture 42B
com.apple.metadata:kMDItemScreenCaptureType 49B
-rw-r--r--@ 1 gjp22 wheel 871K 14 Mar 18:09 screenshot 2013-03-14 at 18.09.39.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 49B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 1.5M 14 Mar 18:09 screenshot 2013-03-14 at 18.09.54.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemIsScreenCapture 42B
com.apple.metadata:kMDItemScreenCaptureType 49B
-rw-r--r--@ 1 gjp22 wheel 1.8M 14 Mar 18:10 screenshot 2013-03-14 at 18.10.04.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 49B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 1.4M 14 Mar 18:11 screenshot 2013-03-14 at 18.11.32 (2).png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 49B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 1.1M 14 Mar 18:11 screenshot 2013-03-14 at 18.11.32.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 49B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 1.4M 14 Mar 18:15 screenshot 2013-03-14 at 18.15.19 (2).png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 49B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 1.4M 14 Mar 18:15 screenshot 2013-03-14 at 18.15.19.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 49B
com.apple.metadata:kMDItemIsScreenCapture 42B
-rw-r--r--@ 1 gjp22 wheel 1.4M 14 Mar 18:15 screenshot 2013-03-14 at 18.15.44 (2).png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemIsScreenCapture 42B
com.apple.metadata:kMDItemScreenCaptureType 49B
-rw-r--r--@ 1 gjp22 wheel 1.2M 14 Mar 18:15 screenshot 2013-03-14 at 18.15.44.png
com.apple.FinderInfo 32B
com.apple.metadata:kMDItemScreenCaptureType 49B
com.apple.metadata:kMDItemIsScreenCapture 42B
macbookpro08-centrim:~ gjp22$
(Then, most noticeable with Finder, various issues with the content of the directory, which made me worry about file system corruption, but those issues were transient. I might post details to a separate topic.)
/Volumes/gjp22
is my ZFS home directory, an encrypted Core Storage logical volume given to ZEVO.
Following a restart of the OS: the two screenshots were usable but still, their extended attributes are empty.
I renamed and copied both files. With copies temporarily on HFS Plus I can use fileXray …
- Code: Select all
sh-3.2$ date
Sat 16 Mar 2013 14:10:42 GMT
sh-3.2$ sw_vers
ProductName: Mac OS X
ProductVersion: 10.8.3
BuildVersion: 12D78
sh-3.2$ sudo fileXray /Volumes/disk0s3/2013-03-14\ 17-54-35\ screenshot\ 1.png
Password:
path = disk0s3:/2013-03-14 17-54-35 screenshot 1.png
# Catalog File Thread Record
# Record 38 in node 1 beginning at 512-byte sector 0x1c038
parentID = 2
nodeName = 2013-03-14 17-54-35 screenshot 1.png
# Catalog File Record
# Record 13 in node 11 beginning at 512-byte sector 0x1c088
type = file
file ID = 2029
flags = 0000000010000110
. File has a thread record in the catalog.
. File has extended attributes.
. File has date-added stored in Finder Info.
reserved1 = 0
createDate = Thu Mar 14 17:54:36 2013
contentModDate = Thu Mar 14 20:46:04 2013
attributeModDate = Sat Mar 16 14:10:31 2013
accessDate = Sat Mar 16 14:10:31 2013
backupDate = 0
# BSD Info
ownerID = 19236 (gjp22)
groupID = 20 (staff)
adminFlags = 00000000
ownerFlags = 00000000
fileMode = -rw-r--r--
linkCount = 1
textEncoding = 0
reserved2 = 0
# Finder Info
fdType = 0
fdCreator = 0
fdFlags = 0000000000000000
fdLocation = (v = 0, h = 0)
opaque = 0
# Extended Finder Info
reserved1 = 0
date_added = Sat Mar 16 14:10:31 2013
extended_flags = 0000000000000000
reserved2 = 0
reserved3 = 0
# Data Fork
logicalSize = 1275284 bytes (1.3 MB)
totalBlocks = 312
fork temperature = no record in Hot File B-Tree
clumpSize = 0
extents = startBlock blockCount % of file
0x9087 0x138 100.00 %
312 allocation blocks in 1 extents total.
312.00 allocation blocks per extent on an average.
# Resource Fork
logicalSize = 0 bytes
# Attributes
# Attribute Key
keyLength = 98
pad = 0
fileID = 2029
startBlock = 0
attrNameLen = 43
attrName = com.apple.metadata:kMDItemScreenCaptureType
# Attribute Data Record (Inline)
# Record 13 in node 1 beginning at 512-byte sector 0x6040
recordType = 0x10
reserved[0] = 0
reserved[1] = 0
attrSize = 0 bytes
attrData =
# Attribute Key
keyLength = 94
pad = 0
fileID = 2029
startBlock = 0
attrNameLen = 41
attrName = com.apple.metadata:kMDItemIsScreenCapture
# Attribute Data Record (Inline)
# Record 13 in node 1 beginning at 512-byte sector 0x6040
recordType = 0x10
reserved[0] = 0
reserved[1] = 0
attrSize = 0 bytes
attrData =
sh-3.2$ clear
- Code: Select all
sh-3.2$ sudo fileXray /Volumes/disk0s3/2013-03-14\ 17-54-35\ screenshot\ 2.png
path = disk0s3:/2013-03-14 17-54-35 screenshot 2.png
# Catalog File Thread Record
# Record 39 in node 1 beginning at 512-byte sector 0x1c038
parentID = 2
nodeName = 2013-03-14 17-54-35 screenshot 2.png
# Catalog File Record
# Record 14 in node 11 beginning at 512-byte sector 0x1c088
type = file
file ID = 2030
flags = 0000000010000110
. File has a thread record in the catalog.
. File has extended attributes.
. File has date-added stored in Finder Info.
reserved1 = 0
createDate = Thu Mar 14 17:54:37 2013
contentModDate = Thu Mar 14 17:57:42 2013
attributeModDate = Sat Mar 16 14:10:31 2013
accessDate = Sat Mar 16 14:10:31 2013
backupDate = 0
# BSD Info
ownerID = 19236 (gjp22)
groupID = 20 (staff)
adminFlags = 00000000
ownerFlags = 00000000
fileMode = -rw-r--r--
linkCount = 1
textEncoding = 0
reserved2 = 0
# Finder Info
fdType = 0
fdCreator = 0
fdFlags = 0000000000000000
fdLocation = (v = 0, h = 0)
opaque = 0
# Extended Finder Info
reserved1 = 0
date_added = Sat Mar 16 14:10:31 2013
extended_flags = 0000000000000000
reserved2 = 0
reserved3 = 0
# Data Fork
logicalSize = 1450721 bytes (1.5 MB)
totalBlocks = 355
fork temperature = no record in Hot File B-Tree
clumpSize = 0
extents = startBlock blockCount % of file
0x91bf 0x163 100.00 %
355 allocation blocks in 1 extents total.
355.00 allocation blocks per extent on an average.
# Resource Fork
logicalSize = 0 bytes
# Attributes
# Attribute Key
keyLength = 98
pad = 0
fileID = 2030
startBlock = 0
attrNameLen = 43
attrName = com.apple.metadata:kMDItemScreenCaptureType
# Attribute Data Record (Inline)
# Record 15 in node 1 beginning at 512-byte sector 0x6040
recordType = 0x10
reserved[0] = 0
reserved[1] = 0
attrSize = 0 bytes
attrData =
# Attribute Key
keyLength = 94
pad = 0
fileID = 2030
startBlock = 0
attrNameLen = 41
attrName = com.apple.metadata:kMDItemIsScreenCapture
# Attribute Data Record (Inline)
# Record 15 in node 1 beginning at 512-byte sector 0x6040
recordType = 0x10
reserved[0] = 0
reserved[1] = 0
attrSize = 0 bytes
attrData =
sh-3.2$
- Code: Select all
sh-3.2$ date
Sat 16 Mar 2013 14:11:42 GMT
sh-3.2$ sw_vers
ProductName: Mac OS X
ProductVersion: 10.8.3
BuildVersion: 12D78
sh-3.2$ xattr -l /Volumes/disk0s3/2013-03-14\ 17-54-35\ screenshot\ 1.png
com.apple.metadata:kMDItemIsScreenCapture:
com.apple.metadata:kMDItemScreenCaptureType:
sh-3.2$ xattr -l /Volumes/disk0s3/2013-03-14\ 17-54-35\ screenshot\ 2.png
com.apple.metadata:kMDItemIsScreenCapture:
com.apple.metadata:kMDItemScreenCaptureType:
Incidentally these screenshots are the pair that are linked from the opening post under Finder eject, reconnect, panic, type 14=page fault, zpool.
A guess
Loosely speaking, maybe the operating system does not write extended attribute values until after storage of file data is complete.
I guess that:
- the PNG content of both files was stored successfully (the screenshots look OK in apps such as Preview; and GIMP 2.8.4 had no trouble editing one of the two (for confidentiality, I blurred a small area))
- then the kernel panic occurred before extended attribute values could be saved to permanent storage (in this case, ZFS).