Extended Attributes

Overview

Evidence: Extended Attributes Description: Collect Extended File Attributes Category: DiskFilesystem Platform: macos Short Name: extattr Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Extended attributes (xattr) are name-value pairs associated with files and directories that store additional metadata beyond standard file attributes. On macOS, these attributes are extensively used to track file quarantine status, download sources, Finder information, and DMG file metadata. This data is essential for understanding file provenance, detecting suspicious downloads, and investigating file-based incidents.

Data Collected

This collector gathers structured data about extended attributes.

Extended Attributes Data

Field	Description	Example
Path	Path	Example value
AttributeName	Attribute Name	Example value
AttributeValue	Attribute Value	Example value
AttributeSize	Attribute Size	123
AttributeValueHex	Attribute Value Hex	Example value
FileExists	File Exists	true
FileSize	File Size	123
FileModificationTime	File Modification Time	2023-10-15 14:30:25+03:00
QuarantineFlags	Quarantine Flags	Example value
QuarantineAgent	Quarantine Agent	Example value
QuarantineTimestamp	Quarantine Timestamp	2023-10-15 14:30:25+03:00
QuarantineUUID	Quarantine UUID	Example value
WhereFromsURLs	Where Froms UR Ls	Example value
FinderInfoHex	Finder Info Hex	Example value
DMGChecksumType	DMG Checksum Type	Example value
DMGChecksum	DMG Checksum	Example value
DMGChecksumTimestamp	DMG Checksum Timestamp	2023-10-15 14:30:25+03:00

Collection Method

This collector recursively scans configurable directories (default: /Users, /Applications) and uses the xattr package to retrieve all extended attributes for each file. It parses common macOS-specific attributes including quarantine information, download sources (kMDItemWhereFroms), Finder metadata, and DMG checksums. Results are stored in the extended_attributes table with both raw and parsed attribute values.

Forensic Value

This evidence is crucial for forensic investigations as it reveals file download history, quarantine status, source URLs, and file handling metadata. It helps identify potentially malicious downloaded files, trace the origin of files, detect quarantine bypass attempts, and understand file interactions with system features like Gatekeeper.