OSXFAQ Mac OS X UNIX Tip-of-the-Day 

I'm sure you're familiar with Apple's Spotlight and its powerful search capabilities. It searches file content rapidly using a pre-built content index database. It also searches for information about files, making use of metadata. Metadata is data about data. For example, an image created by Photoshop contains data that is the image itself, but the filename, date stamp, owners, file size, and such like form the metadata.

(Note: Spotlight was introduced in Mac OS X Tiger 10.4)

Apple, being a nice Unix player, has opened up the power of Spotlight to the command line. Let's look at what's available in Terminal land.

The 'mdls' command (metadata ls) shows all metadata attached to a file or directory. For example, if we mdls a TextEdit file saved in Rich Text format we see:

$ mdls schedule.rtf 
schedule.rtf -------------
kMDItemAttributeChangeDate     = 2006-02-06 00:59:21 +0000
kMDItemContentCreationDate     = 2004-06-03 17:17:17 +0100
kMDItemContentModificationDate = 2006-02-06 00:59:21 +0000
kMDItemContentType             = "public.rtf"
kMDItemContentTypeTree         = ("public.rtf", "public.text", "public.data", "public.item", "public.content")
kMDItemDisplayName             = "schedule"
kMDItemFSContentChangeDate     = 2006-02-06 00:59:21 +0000
kMDItemFSCreationDate          = 2004-06-03 17:17:17 +0100
kMDItemFSCreatorCode           = 0
kMDItemFSFinderFlags           = 16
kMDItemFSInvisible             = 0
kMDItemFSIsExtensionHidden     = 1
kMDItemFSLabel                 = 0
kMDItemFSName                  = "schedule.rtf"
kMDItemFSNodeCount             = 0
kMDItemFSOwnerGroupID          = 501
kMDItemFSOwnerUserID           = 501
kMDItemFSSize                  = 7607
kMDItemFSTypeCode              = 0
kMDItemID                      = 923169
kMDItemKind                    = "Rich Text Format (RTF) document"
kMDItemLastUsedDate            = 2006-02-06 00:59:21 +0000
kMDItemUsedDates               = (
    2006-01-14 00:00:00 +0000, 
    2006-01-20 00:00:00 +0000, 
    2006-01-21 00:00:00 +0000, 
    2006-01-23 00:00:00 +0000, 
    2006-02-05 00:00:00 +0000, 
    2006-02-06 00:00:00 +0000
)

You'll see all the usual metadata normally displayed by 'ls -l', such as filename name:

kMDItemFSName                  = "schedule.rtf"

and user and group owner (shown as numeric IDs - the translation to textual names is performed by ls):

kMDItemFSOwnerGroupID          = 501
kMDItemFSOwnerUserID           = 501

You'll notice other metadata too, such as:

kMDItemDisplayName - the name as shown in the Finder, which often means without the extension.

kMDItemKind - the type of content.

Metadata with the types kMDItemFS* is information from the filesystem. Other metadata types concern the file contents and is not information that ls reports.

BTW, Spotlight stores its content index and metadata store are held in a directory at the top level of each file system:

$ sudo ls  /.Spotlight-V100/
.journalHistoryLog ContentIndex.db    _exclusions.plist  store.db
.store.db          _IndexPolicy.plist _rules.plist

Each file system has its own Spotlight store ensuring that this information travels with the files to which it belongs.

Tomorrow, we'll look at what metadata is available for other types of file content.