everyday mac tools

What is this folder on my Mac? Finding the app that made it

· 7 min read

Most mystery folders can be traced in a few minutes. The name usually points to the app, Get Info shows when the folder appeared, and Activity Monitor or one Terminal command shows whether anything is using it right now. Once you know the owner, deciding whether it can go is easy. Until you know, move it to the Trash rather than deleting it, and leave anything that belongs to Apple alone.

Start with the name

The name is the quickest clue and is right more often than not.

  • Named after an app or a company. The obvious case. A folder of recordings in Documents named after a video-call app belongs to that app.
  • Reverse-domain names such as com.developer.appname. Read it backwards: the developer’s web domain, then the app. Anything beginning com.apple. belongs to macOS or one of Apple’s own apps.
  • Names beginning with a dot in your home folder, such as .config, .cache or .ssh. These are hidden by default; press Shift-Command-Period in Finder to see them. They mostly come from command-line and developer tools. One warning: .ssh holds keys used to log in to other computers, and deleting it can lock you out of servers you rely on.
  • Generic names such as Data, Support or Temp. These need the steps below.

For a name that means nothing to you, type it into Spotlight. If an app with a matching name is installed, it usually appears at the top. Show hidden files in Finder, and hide them again covers the dot folders in more detail.

Work out when it appeared, then look inside

  1. Select the folder and choose File, Get Info (Command-I).
  2. Note the Created date. That is the day the owning app first ran, or first needed the folder.
  3. Open your Applications folder in list view, press Command-J, and tick Date Added. Sort by that column.

An app added on the same day as the folder is the prime suspect. Next, open the folder in list view and sort by Date Modified: if the newest file inside is from this morning, something is still writing to it. If nothing has changed in years, it is probably left over from an app you removed long ago.

Then look inside. Select a file and press Space to see it in Quick Look, which reads without modifying anything.

  • .plist files are preference files. The keys inside often carry the app’s name or reverse-domain identifier.
  • .log files frequently name the app in their first lines, along with a version number.
  • Database files (.db, .sqlite) are an app’s working data. Do not open them in an editor and save; look only.

In Terminal, plutil -p prints a preference file in readable form without changing it:

plutil -p ~/Library/Preferences/com.example.app.plist

Check whether anything is using it now

A folder in active use belongs to something running right now. This command lists every file inside the folder that a process has open, with the process name in the first column:

lsof +D ~/Documents/Mystery

No output means nothing has a file open there at this moment: useful evidence, not proof.

The same check without Terminal: open Activity Monitor, double-click a process you suspect, and choose the Open Files and Ports tab. If the folder’s path appears in the list, you have found the owner.

Background helpers and launch agents

Some folders belong to helpers that run in the background rather than to an app you open. Two places show them.

System Settings, General, Login Items & Extensions (Login Items on earlier versions of macOS). The Allow in the Background list shows each background item, usually with the developer’s name. You can switch one off there without deleting anything.

The launch agent folders: ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons. Each .plist inside tells macOS to start a program. Print one with plutil -p and look for the Program or ProgramArguments key, which gives the path of the program it starts. Then ask macOS who signed that program:

codesign -dv --verbose=2 "/Library/Application Support/Example/helper"

The lines beginning Authority= name the certificate it was signed with, normally “Developer ID Application” followed by the developer’s name. A program with no signature at all, launched from a folder you do not recognize, deserves a closer look; What to do the hour after you think your Mac was compromised covers that situation.

Deciding whether it can go

With the owner identified, the decision follows.

  • It belongs to Apple (com.apple. names, anything under /System): leave it.
  • It belongs to an app you still use: it is that app’s data. Clear it from inside the app if the app offers a way, because deleting it by hand usually means lost settings or a folder that reappears on the next launch.
  • It belongs to an app you removed: move it to the Trash and leave the Trash unemptied for a week. Uninstall an app on a Mac completely lists the other places that app probably left files.
  • You still do not know: leave it, or move it to the Trash and watch for anything that breaks before emptying.

Caches regenerate; settings, keys and app data do not. Which caches are safe to delete on a Mac draws that line in detail, and Application Support taking up space on a Mac covers the folder where most of these turn up.

A second opinion from Crumb

Crumb is a menu bar disk cleaner, and its Ask Crumb feature is built for exactly this question. Point it at a file or folder and it explains what the item is, whether it regenerates, and what breaks if it is gone, then proposes a plan. Nothing is deleted until you approve the plan, and reclaimable removals can be reviewed and undone afterward. File contents never leave the Mac, and there is no account.

Ask Crumb is part of the one-time $9 unlock. The free tier covers the read-only whole-Mac audit, the System Data breakdown and one full cleanup. Crumb does not recover deleted files, so the move-to-Trash habit above still applies.

Questions

Is a folder I did not create a sign of malware? Almost never; apps create folders all the time. The signs worth taking seriously are an unsigned program started from a launch agent, or a background item you never approved.

Why does the folder come back after I delete it? Because the app that made it is still installed and recreates it when it runs. Remove the app, or look in its settings for where it saves files; many apps let you choose another location.

It is a single stray file, not a folder. Where did it come from? Select it, choose File, Get Info, and look under More Info for Where from, which shows the web address of a downloaded file. In Terminal, xattr -p com.apple.quarantine followed by the file’s path prints a short record that includes the name of the app that downloaded it, such as Safari or Mail.

Can I move the folder somewhere tidier? Only if the app offers that in its own settings. Moved by hand, the app usually cannot find its data, or it creates a fresh empty folder in the old place.