.DS_Store, Thumbs.db, desktop.ini: the hidden files your OS leaves everywhere

Every folder you copy between computers picks up invisible files you didn't create. What each one is, whether deleting it is safe, how to stop them being made, and the one that can leak information from a web server.

how-tofilesmacoswindows

Copy a folder from a Mac to a USB stick and open it on Windows, or unzip something a colleague made, and you will find files you never created: .DS_Store, ._photo.jpg, Thumbs.db, desktop.ini. They are operating-system bookkeeping, normally hidden, and visible the moment the folder lands somewhere with different rules.

None of them is malware. All of them can be deleted, with small and specific consequences. One of them is worth worrying about in one specific place.

macOS

.DS_Store

What it is. Desktop Services Store: the Finder’s per-folder memory of how you last viewed that folder. Icon positions, the window size, the sort order, the view mode, background images, column widths. Finder writes one into almost every folder you open.

Format. A small binary file in Apple’s “Bud1” B-tree format; the bytes 42 75 64 31 (Bud1) appear at offset 4. See the .DS_Store guide for details.

Safe to delete? Yes. You lose that folder’s view settings, and Finder recreates the file the next time you open the folder.

Stop it on network drives and USB sticks:

defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true
defaults write com.apple.desktopservices DSDontWriteUSBStores -bool true
# then log out and back in

There is no supported way to stop them on the Mac’s own disk, which is fine, because there they are invisible and harmless.

The one real risk: web servers. A .DS_Store contains the names of the files in its folder. Upload a site from a Mac without excluding them, and anyone who requests https://example.com/some-folder/.DS_Store gets a list of what is in that folder, including files that are not linked anywhere: backups, old versions, admin scripts. Security scanners look for this as a matter of routine. Exclude them from deploys, and block them at the server:

location ~ /\.DS_Store { deny all; }

._filename (AppleDouble files)

What they are. When macOS writes a file to a disk that cannot store Mac metadata (FAT32, exFAT, most network shares), it stores that metadata in a companion file: photo.jpg gets ._photo.jpg. Inside are extended attributes such as Finder tags, the “downloaded from the internet” quarantine flag, and resource forks.

Safe to delete? On the non-Mac side, yes; Windows and Linux ignore them. Deleting them on a Mac loses tags and labels for those files.

Clean a drive before handing it over:

dot_clean -m /Volumes/USBSTICK

Also on Mac-touched drives

.Spotlight-V100 (the search index), .fseventsd (the file-change log), .Trashes (the drive’s trash), .TemporaryItems. All safe to delete from a removable drive; macOS rebuilds them when the drive is next mounted.

Windows

Thumbs.db

What it is. A thumbnail cache. Windows XP stored the thumbnails for each folder’s images in a Thumbs.db in that folder. Vista and later moved the cache to a central location (%LocalAppData%\Microsoft\Windows\Explorer\thumbcache_*.db), but Windows still writes Thumbs.db on network shares unless told not to.

Format. An OLE2 compound document, the same container as old Word files; it starts D0 CF 11 E0 A1 B1 1A E1. See the Thumbs.db guide.

Safe to delete? Yes. Thumbnails regenerate.

The classic annoyance. You try to delete or rename a folder on a network drive and Windows says the action “can’t be completed because the file is open in Windows Explorer”. The file is usually Thumbs.db, held open because Explorer is showing that folder’s thumbnails. Switch the view to Details or close the window, then try again.

Stop it on network shares. In Group Policy (gpedit.msc): User Configuration, Administrative Templates, Windows Components, File Explorer, Turn off the caching of thumbnails in hidden thumbs.db files: Enabled.

A privacy note. Thumbnails can outlive the images they show. A Thumbs.db in a folder whose pictures were deleted may still contain small previews of them, which is why the format appears in forensics training. If you are cleaning a folder of sensitive images, delete the cache too.

desktop.ini

What it is. A plain-text INI file that customises how Explorer shows a folder: a custom icon, a localized display name, a tooltip, which pane opens. It is why C:\Users\you\Documents can appear as “Documents” in English and “Dokumente” in German while the folder on disk keeps one name.

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21770
IconResource=%SystemRoot%\system32\imageres.dll,-112

Safe to delete? Usually. You lose the custom icon or the translated name, nothing else. Leave the ones in system folders (Documents, Pictures, Desktop) alone if you want them to keep their names and icons. See the INI guide.

Why it appears twice on your desktop. If both “show hidden files” and “show protected operating system files” are on, you see the desktop.ini from your own Desktop folder and the one from the Public desktop, because Windows merges the two into one view. Turning off protected files hides them again.

Also on Windows-touched drives

$RECYCLE.BIN (the drive’s recycle bin) and System Volume Information (restore points and indexing data). Leave them on internal drives. On a USB stick you are giving away, emptying the recycle bin first is enough; Windows will recreate the folder.

Linux

Less of this, but not none. KDE’s Dolphin writes .directory files with per-folder view settings, the same idea as .DS_Store in plain text. GNOME keeps its thumbnail cache centrally in ~/.cache/thumbnails, so it leaves nothing in your folders.

Keeping them out of Git and archives

A .gitignore entry covers every project; a global one covers them all:

# OS metadata
.DS_Store
._*
.Spotlight-V100
.Trashes
Thumbs.db
ehthumbs.db
desktop.ini
.directory

# Apply it to every repository on this machine
git config --global core.excludesFile ~/.gitignore_global

When zipping a folder on a Mac for someone on Windows, the Finder’s Compress adds a __MACOSX folder full of ._ files. Use the terminal instead to leave them out:

zip -r project.zip project -x "*.DS_Store" -x "__MACOSX/*" -x "*/._*"

See the ignore-file guide for more on .gitignore and its relatives.

The summary table

File Made by What it holds Delete?
.DS_Store macOS Finder Folder view settings, file names Yes; never deploy to a web server
._name macOS on non-Mac disks File metadata and tags Yes, on the non-Mac side
Thumbs.db Windows (network shares) Image thumbnails Yes; mind privacy
desktop.ini Windows Explorer Folder icon and display name Usually; keep in system folders
.directory KDE Dolphin Folder view settings Yes

If you find a hidden file that is not on this list and are not sure what it is, the name can lie, but the bytes cannot: drop it on the detector before deciding.

← All posts