101

When I ls my Desktop from terminal (by using ls ~/Desktop), I see a file named Icon?. As far as I can tell, it's empty (nano Icon? shows nothing). It doesn't show up on my actual Desktop, and open Icon? shows the Finder alert

This item is used by Mac OS X and can't be opened

Here is the output from mdls Icon?:

kMDItemContentType         = ""
kMDItemFSContentChangeDate = 2009-09-23 13:32:52 -0600
kMDItemFSCreationDate      = 2009-09-20 07:27:46 -0600
kMDItemFSCreatorCode       = "MACS"
kMDItemFSFinderFlags       = 16384
kMDItemFSHasCustomIcon     = 0
kMDItemFSInvisible         = 1
kMDItemFSIsExtensionHidden = 0
kMDItemFSIsStationery      = 0
kMDItemFSLabel             = 0
kMDItemFSName              = "Icon "
kMDItemFSNodeCount         = 0
kMDItemFSOwnerGroupID      = 20
kMDItemFSOwnerUserID       = 501
kMDItemFSSize              = 0
kMDItemFSTypeCode          = "icon"

Does anyone have an idea as to what this is?

L3viathan
  • 156
  • 1
  • 8
Chris
  • 1,228
  • 2
  • 11
  • 13
  • 11
    The real question is: is there a way to stop the operating system from creating these damn files in every directory? It really annoys me that they show up in Dropbox. – JeremyKun Mar 20 '15 at 23:02
  • 3
    These files are NOT created automatically "in every directory" unless you have some nasty software that causes their creation. Also - they may annoy you, but they have their functionality too. This the implementation of "Custom user-icon" in MacOS. If user elects to paste any image of his liking to serve as the icon of some file or directory - it will end up as a hidden iCon? file. Deleting them simply removes the custom icon. – Motti Shneor Nov 20 '18 at 12:10

4 Answers4

124

What is it?

It's name is actually Icon\r, with \r being the carriage return 0x0D. If letting the shell autocomplete the path in Terminal, it yields Icon^M, ^M being \r.

Icon^M is a file existing in all directories that have a custom icon in Finder. If you change a directory's icon e.g. in its Get Info dialog by pasting an image into the icon in the upper left corner, the Icon^M file is created.

Changing a volume's icon creates a hidden .VolumeIcon.icns file instead.

Why is it invisible?

It's invisible in Finder, because its hidden attribute is set.

$ ls -lO Icon^M 
-rw-r--r--@ 1 danielbeck  staff  hidden 0 24 Apr 23:29 Icon?

Change with chflags nohidden Icon^M.

Where is its data?

While the file's data fork (i.e. content) is empty (i.e. a file size of 0 bytes in Terminal), the actual icon data is stored in the file's resource fork.

$ ls -l@ Icon^M
    com.apple.ResourceFork  350895

You can copy the resource fork to a file (to view e.g. in a hex editor) like this:

$ cp Icon^M/..namedfork/rsrc Icondata

How can I view it?

The easiest way to get the image is to copy the icon from the Get Info dialog of the folder it's contained in into the clipboard, and then create a new image from clipboard in Preview (Cmd-N). It's an icns image then by default.

Its format is icns, encoded as an icon resource with derez. If you open it in a hex editor and remove the first 260 bytes (so the file begins with the icns magic byte-string), you can open it in Preview.app. Alternatively you can open it with XnView

Sam Denty
  • 6,141
  • 3
  • 11
  • 16
Daniel Beck
  • 109,300
  • 14
  • 287
  • 334
  • [How to create a rsrc icon file otherwise](http://superuser.com/questions/187819/finder-sidebar-icons-how-do-i-duplicate/254064#254064). – Daniel Beck Jun 18 '11 at 04:43
  • 4
    Apple actually do this hiding of their data in a resource fork quite frequently. I can never decide if it's neat or misleading. – Lukasa Jun 18 '11 at 10:10
  • 2
    It's consistent. Icons after all _are_ resource fork contents. – JdeBP Jun 18 '11 at 11:21
  • 1
    @JdeBP I mention the inconsistency with volume icons in my post. I don't want to see what inconsistency would look like then ;) – Daniel Beck Jun 18 '11 at 17:31
  • 3
    You miss the wood for a single tree, grasshopper. Look beyond a volume icon file to the great forest of cases where, traditionally in MacOS at least, _icons are to be found in resource forks_. If you're trying to be all modern and hip and we-don't-need-no-steenking-resource-forks-we're-Unix-now, you should really correct your answer to use the modern and hip `/..namedfork/rsrc` suffix instead of the one that generates a warning message. (-: – JdeBP Jun 18 '11 at 17:58
  • 3
    @JdeBP I don't care one way or another about the resource fork icons, but it's still inconsistent with `.VolumeIcon.icns`. Thank you for the `..namedfork` hint, but I don't get a warning from `File/rsrc`. I read that I should, but where does it appear? – Daniel Beck Jun 18 '11 at 20:08
  • 2
    My amazing [psychic](https://trac.macports.org/ticket/18859) [powers](https://trac.macports.org/ticket/7645) tell me that [all of these `printf`s](http://www.opensource.apple.com/source/xnu/xnu-1504.9.37/bsd/hfs/hfs_lookup.c) go to the system log. – JdeBP Jun 19 '11 at 00:47
  • @JdeBP Your amazing psychic powers are broken. I checked the system log even before commenting yesterday. It's actually the kernel log. – Daniel Beck Jun 19 '11 at 05:39
  • They are [one and the same with many people's actual `syslog.conf`s on MacOS](http://serverfault.com/questions/42495). The `kern.debug` facility messages generated by [`printf`](http://freebsd.org/cgi/man.cgi?query=printf&sektion=9) are directed to `system.log`. Don't believe the example configuration file in Apple's documentation. – JdeBP Jun 19 '11 at 09:25
  • @JdeBP If you're referencing that post's first comment, the line following that one, at least in my `/etc/syslogd.conf` is `kern.* /var/log/kernel.log`. Since you link to `xnu` sources, it's reasonable to assume that these `printf`s end up in `kernel.log` via `kern.*, no? I didn't believe some `man` page, it's where the messages are actually logged on my system... – Daniel Beck Jun 19 '11 at 09:35
  • All these `printf` messages without explicit prival prefixes come out of the kernel as `kern.debug` as far as `syslogd` is concerned, grasshopper. That you yourself may not send `kern.debug` to `system.log` does not change the truth of the many people who do. The earnest seeker for truth that can use a WWW search engine to look for the `syslog.conf`s of others will find true enlightenment. (-: – JdeBP Jun 19 '11 at 12:09
  • I had to delete the custom icon of a folder to get that folder into SVN... – Jonny May 27 '14 at 08:01
  • @Lukasa - It's consistent (as JdeBP noted) but it's also *historical*. The collision of NeXT and Classic MacOS meant many hard decisions about which conventions to keep, which to discard, and when to attempt both. Resource Forks on OS X were more painful until they were moved to [Extended Attributes](http://arstechnica.com/apple/2005/04/macosx-10-4/7/) (John Siracusa's OS X 10.4 Tiger Review's section on their introduction). – Lake Jan 05 '15 at 23:52
  • Should I add it to my `.gitignore` file? – ma11hew28 Aug 29 '16 at 20:05
  • @DanielBeck "copy the icon from the *Get Info* dialog of the folder it's contained in into the clipboard" How do you do that? – LarsH Jun 16 '20 at 19:51
  • For Zsh at least, I use `Icon$'\r' for the correct filename. – David J. Dec 23 '20 at 07:56
  • 2
    *Why* would they choose to put a trailing return `\r` in the filename? – RexYuan Jan 13 '21 at 21:19
14

An Icon? file inside a directory contains a custom icon image for that directory. The image itself is stored inside an extended file attribute, specifically, com.apple.ResourceFork, which is why the Icon? file appears to have no length.

You can retrieve that data with $ xattr -p com.apple.ResourceFork Icon? or view all extended attributes with $ xattr -l Icon?

On Snow Leopard, at least, they appear to have been phased out for system icons (In the case of ~/Desktop/, that icon would be visible when viewing your home directory in icon view.) but for the two custom directory icons I have on my system, it still exists.

NReilingh
  • 5,737
  • 3
  • 27
  • 52
  • The "system icons" have never created an `Icon^M` file as far as I know. Rename these special folders with custom icons (easiest to do with `~/Applications`, as it doesn't exist by default anyway) and their icon will change with it. – Daniel Beck Jun 18 '11 at 04:45
  • @Daniel Yup; I suppose OP has a customized icon for his Desktop folder, then. – NReilingh Jun 18 '11 at 04:47
8

What is it?

It is the file that stores the Image for your Folder Icon, I was only able to get this to be created if I manually loaded an image to the folder. I don't have these on my system by default.

How To Find the Icon^M files

NOTE:

This is not the same as .icns file extension.

Should you be paranoid about if finding a false positive then use:ctrl+v ctrl+m instead of ?

#!/bin/bash
# =============================================================================
# MAC OSX HIGH SIERRA 10.13.4 (17E199)
# Terminal: Version: 2.8.2 64-Bit (Intel): Yes
# Terminal Location: /Applications/Utilities/Terminal.app
# =============================================================================

echo 'Searching Documents for Icon files...'
find ~/Documents -type f -name 'Icon?' -print;

How To Create the Icon^M file

  1. Open Finder
  2. Right Click On a Folder
  3. Press & Hold Option on your keyboard
  4. Select Show Inspector
  5. Drag an image to the top left folder icon.
  6. Run ls -lah on that directory
    1. You should see:
      • -rw-r--r--@ 1 username staff 0B May 13 22:23 Icon?

How Remove the Icon^M file

Should you need to remove it for any reason... say accidentally on purpose testing it.

#!/bin/bash
# =============================================================================
# MAC OSX HIGH SIERRA 10.13.4 (17E199)
# Terminal: Version: 2.8.2 64-Bit (Intel): Yes
# Terminal Location: /Applications/Utilities/Terminal.app
# =============================================================================

echo 'Removing Icon files from Documents...'
find ~/Documents -type f -name 'Icon?' -print -delete;

Reference from my post on another question:

How can I delete empty folders in Mac OS X?

JayRizzo
  • 242
  • 2
  • 10
  • 1
    +1, since "How to Remove" missing from the accepted answer. And no, they're not useful when accessed from Windows, via minGW's bash. – gbarry Feb 15 '19 at 18:41
  • Using `?` leads to unnecessary positives. Be more precise by using [ANSI-C Quoting](http://www.gnu.org/software/bash/manual/html_node/ANSI_002dC-Quoting.html). For example: `find . -type f -name $'Icon\r' -print;` – David J. Dec 23 '20 at 16:38
  • The current command, which uses `-name 'Icon?'`, may give false positives. Combined with the `-delete` action, it is not safe. Having `-type f` is a step in the right direction but not sufficient. Just because the likelihood of false positives may 'seem' small does not make the command safe. A better alternative exists: specify the filename precisely with ANSI-C Quoting, as I mention above: `-name $'Icon\r'` – David J. Dec 23 '20 at 16:41
2

The Icon^M file is a hidden macOS system file that manages a custom image for the containing folder. However, users may find these files created for other reasons.

For example, the macOS version of Google Drive would create an Icon file in every folder in order to track sync status.

You may safely delete these files. While in Terminal, from the parent directory, run the following command: (be sure to insert the ^M with the ctrl-v, ctrl-m keystrokes):

find . -type f -name 'Icon^M' -exec rm -f {} \;
jkmartindale
  • 434
  • 1
  • 4
  • 11
Mike Conant
  • 21
  • 1