Utility to recapture items with extended attributes

QRecall Extended Attribute Nudge Utility
Download: http://www.qrecall.com/release/QRecallNudge.dmg

QRecall version 1.1.0(25) beta introduced the ability to capture and restore extended attributes. Items captured with 1.1.0(25) or later will include extended attribute information.

However, QRecall only captures items that are new or have changed. An item captured with a pre-1.1.0(25) version will not contain any extended attribute information, but that same item won't be recaptured (capturing its extended attribute information) until it changes.

The QRTouchXAttrItems tool is a simple command line executable that will fix this problem. It searches a directory tree for any item that has extended attributes and "touches" it. QRecall will then recapture the item the next time a capture is performed.

To use the tool, open a Terminal window and execute the tool from the command line. The tool expects a single parameter which is the directory to scan.

The tool must have access to the items it is scanning, so run it using sudo to touch items that you don't own.

For example, to scan the entire boot volume:


cd /Volumes/QRecall\ Extended\ Attribute\ Nudge\ Utility/

sudo ./QRTouchXAttrItems /

The tool will scan the entire directory tree for any item that has one or more extended attributes. When it finds one it will "nudge" (add one second to) its last modification date. This is enough to convince QRecall that the item has changed and needs to be recaptured.

QRTouchXAttrItems will ignore all special file types (block devices, pipes, etc.) and does not traverse symbolic links.

Extended attributes are "named metadata associated with a filesystem object" such as a file, directory, symlink, etc. Each extended attribute consists of a unique name and a small bit of data that can be attached to any file or folder. This bit of data will (assuming something doesn't strip it off) stay with that item wherever it goes.

To give you an example, when you download a file from the Internet in OS X 10.5 (Leopard), a tiny chunk of data is attached to the file with the name "com.apple.quarantine". com.apple.quarantine is an extended attribute attached to the downloaded file. Whenever you open a file or application that has a com.apple.quarantine extended attribute, the Finder will warn you that you're about to open something downloaded from the Internet. If you say that's OK, the com.apple.quarantine extended attribute is removed.

Tiger had the ability to use extended attributes, but made little or no use of them. Leopard has begun to make use of extended attributes and their use is growing daily, both by Apple and third party applications.

Other examples: The extended attribute "com.apple.metadata:kMDItemWhereFroms" records the URL where an item was downloaded from. The "com.apple.TextEncoding" extended attributes identifies the encoding of a text file so the application doesn't have to guess. "com.apple.diskimages.recentcksum" records checksum calculations which help disk images mount faster.

Some extended attributes, like "com.apple.FinderInfo" and "com.apple.ResourceFork" mirror legacy item metadata (which QRecall already captures).

You can see the extended attributes of an item using the -@ switch of the ls command (in conjunction with the -l switch). So, to see the extended attributes of the items in your Documents folder, open up a Terminal window and type

ls -l@ ~/Documents

Note: I've uploaded a newer version of the QRTouchXAttrItems tool that does a better job of ignoring extended attributes that QRecall already captures.