.DS_Store Files

Overview

.DS_Store (Desktop Services Store) files are binary files created by Finder in every directory it has displayed. They store per-folder Finder view settings including icon positions, view mode, sort order, and background images. For forensic investigators, .DS_Store files provide evidence that a directory was accessed via Finder, and the file entries within them reveal filenames that were present in the directory at the time of access -- even if those files have since been deleted.

Forensic Significance

File Locations

.DS_Store files exist in virtually every directory that Finder has displayed:

Data Format

.DS_Store files use a proprietary binary format based on a B-tree structure (Apple's Buddy Allocator format). Each record contains:

Common Record Types

Key Fields for Analysis

Parsing .DS_Store Files

# Using the ds_store Python library
# pip install ds_store
from ds_store import DSStore

with DSStore.open('.DS_Store', 'r') as d:
    for entry in d:
        print(f"{entry.filename}\t{entry.code}\t{entry.value}")

Trash Put-Back Paths

The .DS_Store file in ~/.Trash/ contains ptbL and ptbN records that reveal the original path of trashed files:

from ds_store import DSStore

with DSStore.open('/Users/username/.Trash/.DS_Store', 'r') as d:
    for entry in d:
        if entry.code in ('ptbL', 'ptbN'):
            print(f"{entry.filename}: {entry.code} = {entry.value}")

Analysis Notes

• Deleted file evidence: The most valuable forensic use of .DS_Store files is recovering filenames that were present in a directory but have since been deleted. The filename entries persist in the .DS_Store until the file is regenerated.
• External media: .DS_Store files on external drives (USB, SD cards) prove the drive was accessed from a Mac. The file's creation/modification timestamp provides timing evidence.
• Cross-platform indicator: The presence of .DS_Store files on a non-Mac filesystem (e.g., a Windows NTFS drive or network share) indicates a Mac user accessed the location.
• Trash original paths: The ptbL record type in ~/.Trash/.DS_Store reveals where each trashed file originally lived, even if the Trash has been partially emptied.
• Recursion: Collecting .DS_Store files recursively across an entire volume provides a map of every directory Finder has ever displayed.

Tool Support

References

• .DS_Store Format - Forensics Wiki
• ds_store Python Library
• Buddy Allocator Format Documentation