DSStore Format

In Apple macOS, .DS_Store is a file that stores custom attributes of its containing folder, such as folder view options, icon positions, and other visual information. It is created and maintained by the Finder application in every folder and contains information that can be valuable for forensics purposes, such as file names and timestamps.

When the PList Format package is installed, embedded binary PList objects are automatically extracted.

The DSStore Format package is exposed to the SDK:

from Pro.Core import *
from Pkg.DSStore import *

def parseDSStore(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = DSStoreObject()
    if not obj.Load(c) or not obj.Parse():
        return
    for rec in obj.GetRecords():
        print(rec.filename, rec.id, rec.type, rec.value)