From radmind
# For fseventsd, but can't find any docs on it
d ./.fseventsd 0700 0 80
# database of frequently-accessed small files
a ./.hotfiles.btree 0600 0 0 1179344393 65630 -
# Spotlight database directory. Every writable mounted volume gets one.
d ./.Spotlight-V100 0700 0 80
# Obvious, no? Every volume has its own .Trashes folder
d ./.Trashes 1333 0 99 AAAAAAAAAABAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Used by Carbon applications
d ./.vol 0755 0 0 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Cached information
d ./Library/Caches 1777 0 80
# Console logs, crash reports, etc.
d ./Library/Logs 0775 0 80
# Available network interface information
f ./Library/Preferences/SystemConfiguration/NetworkInterfaces.plist 0644 0 0 1179344420 1887 -
# Machine's rendezvous name, AppleTalk name, DHCP settings, etc.
# Remove this item if you're running a lab.
f ./Library/Preferences/SystemConfiguration/preferences.plist 0644 0 0 1179344421 6893 -
# Network share browsing
d ./Network 0755 0 0 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Cached information (kernel cache, fonts)
d ./System/Library/Caches 0755 0 0
# Extensions caching. Remove the files after installing new kexts.
f ./System/Library/Extensions.mkext 0644 0 0 1179323969 10018928 -
# User home directories. Don't delete them. Use the User Management scripts
# if you need to manage user profiles in a lab.
d ./Users 0755 0 80
# Shared User space, required by some applications
d ./Users/Shared 1777 0 0
# Other volumes mounted here.
d ./Volumes 1777 0 80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# If coring is enabled, here's where cores go.
d ./cores 1775 0 80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Mac OS X uses a devfs and fdesc filesystem to handle /dev and /dev/fd
d ./dev 0755 0 0 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
# temporary files, managed by system
d ./private/tmp 1777 0 0
# Apple caches
f ./private/var/db/BootCache.playlist 0600 0 0 1179344453 66712 -
f ./private/var/db/CodeEquivalenceDatabase 0644 0 0 1179344447 4096 -
f ./private/var/db/SystemEntropyCache 0600 0 0 1179344400 20 -
# DHCP leases
d ./private/var/db/dhcpclient/leases
# Logging facilities. syslogd doesn't create them if they're missing.
f ./private/var/log/alf.log 0644 0 0 1179344422 250 -
f ./private/var/log/asl.db 0600 0 0 1179344558 1924240 -
f ./private/var/log/cups/access_log 0644 0 26 1179344510 654 -
f ./private/var/log/cups/error_log 0644 0 26 1179344558 1901 -
f ./private/var/log/install.log 0644 0 0 1179324023 235104 MIo0he4Pbsg0pebX4yLu/Pwrd+0=
f ./private/var/log/ipfw.log 0640 0 80 1174796825 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/lastlog 0640 0 80 1174796825 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/mb.log 0644 0 0 1179344541 735 -
f ./private/var/log/seatbelt.log 0644 0 0 1179344541 197 -
f ./private/var/log/secure.log 0600 0 80 1174796825 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/windowserver.log 0640 0 80 1179344437 669 -
f ./private/var/log/wtmp 0644 0 80 1174796825 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# radmind client data
d ./private/var/radmind/client 0755 0 0
# where pid information is stored for running processes
d ./private/var/run 0775 0 1
# CUPS print spooling
d ./private/var/spool/cups/cache
# Temporary items, managed by the system.
d ./private/var/tmp 1777 0 0
# Virtual memory
d ./private/var/vm 0755 0 0
