macOS Finder .DS_Store
| Format | macOS Finder .DS_Store |
|---|---|
| Short name | .DS_Store |
| Category | configuration |
| Platforms | macOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Hidden Finder files storing per-directory metadata and view settings in a B-tree database. Records are keyed by file or directory name and can contain information such as icon position, Finder view style, display settings, Spotlight comments and, for directories, timestamps (modD/moDD). Records may persist after the corresponding file has been removed from the directory, making .DS_Store files potentially useful for recovering names and other historical evidence of directory contents. .DS_Store files can also be found outside the original macOS volume, for example on network shares, removable media and in extracted archive contents, because Finder may create them when browsing those locations.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 00 00 00 01 42 75 64 31 | ....Bud1 | Initial alignment value 1 followed by buddy-allocator magic 'Bud1' |
Known extensions
None recorded
References
- DS_Store format (Wim Lewis, Mac::Finder::DSStore) https://metacpan.org/dist/Mac-Finder-DSStore/view/DSStoreFormat.pod
Cite this entry
Crush Format Reference, “macOS Finder .DS_Store”. https://kalink0.github.io/crush-forensics/formats/ds-store/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction