OFFICIAL SECURITY BLOG

We’ve moved! You can now read the latest and greatest on Mac adware and malware at Malwarebytes.

Locating files from paths

Published November 7th, 2013 at 8:58 AM EST , modified April 5th, 2014 at 8:34 AM EDT

Experts will often refer people to files or folders (for removal, editing or other purposes) by using a path. For example, when searching for third-party software that is kept running at all times, users may need to check the “~/Library/LaunchAgents” folder. The average user will have trouble finding this folder, though. This document will help you learn how to track down the item that weird path is pointing you to.

There are a number of different ways you can locate an item when given a path to that item. One way to do so is to use the Reveal in Finder service. To do this, select a path, such as this one:

~/Library/LaunchAgents

The easiest way of doing that is to triple-click the line above. Try that now… put the mouse over any part of that path shown above and click three times fairly quickly. That should select the entire paragraph, which, in the case of the path above, is the entire path and nothing more.

You can also try selecting that path in the first paragraph of this page. Note that, in that case, you will want to select everything inside, but not including, the quotes. If you include one or both of the quotes, it won’t work.

Services -> Reveal in Finder

Services -> Reveal in Finder

Once the path is selected, hold down the control key and click the selected text. You can also perform a secondary (or “right”) click on a trackpad or mouse that supports it. (The trackpad built into modern MacBook Pro computers supports secondary clicks either by clicking with two fingers on the pad – the default – or by clicking in the lower right or left corners, depending on the settings chosen in System Preferences -> Trackpad.) This will open what is called a contextual menu that looks like what is shown at right.

In this contextual menu, you will see an item at the bottom called Services. This item has a triangle at its right edge, indicating that there is a sub-menu associated with that item. Mouse over it to see the sub-menu, then choose the Reveal in Finder item from that sub-menu. This should result in a Finder window opening, showing that item.

Go to Folder, from the Finder's Go menu

Go to Folder, from the Finder’s Go menu

Another method is by using the Go to Folder item in the Finder’s Go menu. Select that menu item, then paste a path into the box, as shown. Be sure to copy that entire path.

(Note that when triple-clicking, the return character at the end of the paragraph is also copied. This makes it look like the box is blank when you paste the copied path into the box, but that’s just because of the return character. You can click Go and it’ll work just fine, or you can press delete once after pasting it into the box to remove the return character. If this bothers you, just select the path normally instead of triple-clicking.)

One important thing to keep in mind here is that Snow Leopard (Mac OS X 10.6) and earlier systems behave a little differently. If you enter the path to a file, rather than a folder, on later systems, the file will be displayed in the Finder. On Snow Leopard and earlier, an error message will be displayed. On such systems, you will have better luck with a different method.

If you are interested in digging a little deeper, you can learn more about what these paths mean. This can be a fairly difficult topic for those who are not familiar with the basic structure of where everything is on their hard drive. It will require quite a bit of exploring and experimentation. It’s important to note that you should not make any changes in any folders outside your user folder without knowing exactly what you are doing! But looking cannot hurt.

One basic concepts you will need to know is what the “root level” of your hard drive is. Since the Finder doesn’t even show your hard drive on the desktop or in the sidebar by default these days, that’s not something some folks are aware of. Choose Computer from the Finder’s Go menu. One item you will see is the hard drive containing your system, which will be named “Macintosh HD” if you haven’t renamed it. Look inside that item and you will be looking at the root level of that hard drive. It should contain folders like Applications, Library and System.

Any path that begins with a slash (‘/’) means that it begins at the root level of the hard drive. For example:

/Library/Application Support/

Some paths may begin with a tilde (‘~’) instead. That indicates that the path begins inside your user folder (the item with your username and the little house icon in the sidebar) instead of at the root level of the hard drive.

All other slashes in a path are delimiters, or separators, that are used to separate each folder name. For example, consider the following path:

/Library/Application Support/Apple/

This path tells us to go to the root level of the hard drive and look for a Library folder. Inside that folder, you will need to find a folder named “Application Support”, and inside that folder will be one named “Apple”.

Generally, a slash at the end of a path is used to indicate that the path points to a folder, rather than a file, but that is not strictly necessary.

It’s also important to understand that many folders in your system are invisible. They are there, but you won’t see them in the Finder. In such cases, you will need to use the other techniques to look inside them.

One final note: if you see a path meant for use in a Unix shell command in the Terminal, you may see that it contains quotes or backslashes (‘\’) inside the path. Such as:

/Library/"Application Support"/Script\ Editor/

These techniques are used to “escape” characters in the path that are illegal within a path in the Unix shell, such as spaces. (Including a space in a command in Unix has a special meaning, so if you don’t put a backslash in front of a space in a path, or put the whole folder name containing a space inside quotes, the command you’re trying to use won’t work.) Such a path will not work with either the Go to Folder or Reveal in Finder methods above.