AppleDouble / AppleSingle
| Format | AppleDouble / AppleSingle |
|---|---|
| Short name | AppleDouble |
| Category | archive |
| Platforms | macOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Containers for Macintosh file metadata and resource forks when the underlying filesystem or transport cannot preserve them natively. AppleDouble stores the metadata in a separate header file, commonly named '._<filename>', alongside the data file; AppleSingle stores the data fork and metadata in a single container. AppleDouble files can contain Finder information, a resource fork and extended attributes; macOS stores extended attributes in an Apple-specific 'ATTR' structure following the Finder Info entry. Modern macOS AppleDouble files can therefore preserve forensic metadata such as com.apple.quarantine, Finder tags and other extended attributes, including download or provenance information where present. They are commonly encountered on non-Mac filesystems and transports and inside ZIP archives, where Finder-created AppleDouble files may occur below __MACOSX/. The containers can preserve metadata that is otherwise absent from the corresponding data file and can therefore provide valuable evidence about file provenance, Finder state and historical file attributes.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 00 05 16 07 | .... | AppleDouble magic 0x00051607 |
| offset 0 (0x0) | 00 05 16 00 | .... | AppleSingle magic 0x00051600 |
Known extensions
None recorded
References
- MIME Encapsulation of Macintosh Files — MacMIME (RFC 1740) https://www.rfc-editor.org/rfc/rfc1740.html
- copyfile.c — AppleDouble '._' layout with ATTR extended attributes (Apple OSS) https://github.com/apple-oss-distributions/copyfile/blob/main/copyfile.c
Cite this entry
Crush Format Reference, “AppleDouble / AppleSingle”. https://kalink0.github.io/crush-forensics/formats/appledouble/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction