From radmind
# For fseventsd, but can't find any docs on it
d ./.fseventsd 0700 0 80
# Spotlight database directory. Every writable mounted volume gets one.
d ./.Spotlight-V100 0700 0 80
# Obvious, no? Every volume has its own .Trashes folder
d ./.Trashes 1333 0 99 AAAAAAAAAABAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Used by Carbon applications
d ./.vol 0755 0 0 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Cached information
d ./Library/Caches 1777 0 80
# Console logs, crash reports, etc.
# ./Library/Logs
# Network share browsing
d ./Network 0755 0 0 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Cached information (kernel cache, fonts)
d ./System/Library/Caches 0755 0 0
# User home directories. Don't delete them. Use the User Management scripts
# if you need to manage user profiles in a lab.
d ./Users 0755 0 80
# Shared User space, required by some applications
d ./Users/Shared 1777 0 0
# Other volumes mounted here.
d ./Volumes 1777 0 80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# If coring is enabled, here's where cores go.
d ./cores 1775 0 80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Mac OS X uses a devfs and fdesc filesystem to handle /dev and /dev/fd
d ./dev 0755 0 0 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
# temporary files, managed by system
d ./private/tmp 1777 0 0
# Logging facilities. syslogd doesn't create them if they're missing.
f ./private/var/log/install.log 0644 0 0 1179324023 235104 MIo0he4Pbsg0pebX4yLu/Pwrd+0=
f ./private/var/log/ipfw.log 0640 0 80 1174796825 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/lastlog 0640 0 80 1174796825 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/secure.log 0600 0 80 1174796825 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/wtmp 0644 0 80 1174796825 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# radmind client data
d ./private/var/radmind/client 0755 0 0
# where pid information is stored for running processes
d ./private/var/run 0775 0 1
# Temporary items, managed by the system.
d ./private/var/tmp 1777 0 0
# Virtual memory
d ./private/var/vm 0755 0 0
