Hidden icon? files keep getting created in Mac Finder. :(

To me it looks like the default icon for folders has been changed/customized. I'm seeing folders with a little person icon where the default folder icon is just plain blue.

Since the default has been changed, every folder will have the Icon? 'file' which contains a link to the custom icon.

Can you try removing the custom icon from one folder? You select a folder, then right click and choose Get Info. In the info window that appears, click on the icon in the upper left corner and then press the Delete button. This removes the custom icon from that folder, and the Icon? 'file'.

To me it looks like the default icon for folders has been changed/customized. I'm seeing folders with a little person icon where the default folder icon is just plain blue. 

Good observation. I hadn't noticed that.
I'm sure this is already obvious, I had the user turn on hidden files in Finder with Command + Shift + period.

The owner of this laptop isn't likely to have done this purposefully. I asked her, and she didn't fully understand the question. She isn't very familiar with the MacOS.

To be clear, changing the default icon, doesn't appear to be very trivial, or at least something that can be done by accident.

These instructions appear to show how it's done, and how to turn it off. Do you agree?
https://support.apple.com/en-ca/guide/mac-help/mchlp2313/mac

Can you try removing the custom icon from one folder? You select a folder, then right click and choose Get Info. In the info window that appears, click on the icon in the upper left corner and then press the Delete button. This removes the custom icon from that folder, and the Icon? 'file'.

If the above link is successful in turning off this custom icon thing, but there are still many of these hidden files. What is the best way to remove them globally from terminal? The problem is that macOS writes the icon data as a resource fork to the file, by default, the Icon? is a hidden file and the ? is actually a darn linefeed \n  character. Maybe not a simple thing to find and delete across the entire hard drive?

Further reading, it seems that the way to eliminate this icon data is with:

xattr -d com.apple.ResourceFork /path/to/filename 

Select allOpen in new window

But there are hundreds of these icons, how can I eliminate them recursively?

Another way is to use SetFile to flip the file's "custom icon" bit off with:

SetFile -a c /path/to/file

Select allOpen in new window

But what /path/to/file? They are everywhere. I think I need to do this recursively.

Maybe this will work?

find . -name "Icon?" -print0 | xargs -0 rm -rf

Select allOpen in new window

Oh no... this isn't specific enough. That command will seek and destroy any file with "Icon." I need something that will more specifically remove the problematic icon files. :( 

She probably just pressed command shift . (period) to show "hidden files".  Just press command shift . (period) again and it will hide it again.

Hi serialband,
You misunderstood the problem. :)

I instructed her to turn on hidden files so that we could see where those hidden files are located because they are causing problems with other systems.

I want to turn off the creation of these hidden Icon? (or Icon/r) files.

Maybe turn off Finder Thumbnail Icon Preview? https://osxdaily.com/2013/01/10/disable-finder-icon-thumbnails-previews-mac-os-x/

I verified earlier that when you restore the folder icon to it's default that the special file gets removed. I'll check that link later today. 

>> Maybe this will work?
>> find . -name "Icon?" -print0 | xargs -0 rm -rf

No this is not going to work because of 2 reasons: the ? does not match the special character and the rm command will not find the file to remove.

Can you test following:
- Go to the folder named "German" in a terminal window
- Enter this command: find . -name "Icon^M" | xargs ls -l
  (note: you type the special character by entering ctrl-v followed by ctrl-m )

The above command will show you at least one of the Icon? files as I see one in "German", like this:

$ find . -name "Icon^M" | xargs ls -l
-rw-r--r--@ 1 gerwin  staff  0 Jan 19 23:07 ./test/Icon?

- Now you should be able to the file (or files) like this: find . -name "Icon^M" -delete
   (note: you type the special character by entering ctrl-v followed by ctrl-m )

When this one works - move to a different (higher) directory and repeat.

Important note: if the first command (with ls -l) finds other files - do not execute the second command.

Thank you Gerwin Jansen 

I failed to update this EE Question. After some experimenting, I found that this command works:

find . -name Icon$'\r' -delete

Select allOpen in new window

I think your suggestion will do the same.

When this one works - move to a different (higher) directory and repeat.

I agree. That is a good strategy. But the question remains, what will actually "turn off" the creation of these icons when new files and folders are saved in Finder?

I'm really baffled that no MacOS expert can explain how to stop this; it's also frustrating that I do not have access to the problem Mac to experiment with possible solutions. My gosh, if this was a similar Windows issue, I'd have a solution very quickly. LOL  

>>explain how to stop this
When you said A colleague "did something"  - do you know if it was just a single action or did it take some more effort to make the change?

There are procedures out there on how to change the default folder icon on MacOS - those are not just a single action - they take some more effort. I'll like a video down below that describes the procedure - it is about changing CoreTypes.

You could ask your colleague if this procedure qualifies as 'something' and since the procedure starts with backing up the Core Types - it could be undone.

https://youtu.be/2CbxMPWfNH0

Which OS X does she have?  Is she still using HFS+ on the disk?

You could ask your colleague if this procedure qualifies as 'something' and since the procedure starts with backing up the Core Types - it could be undone.

https://youtu.be/2CbxMPWfNH0 

I am 100% certain that she didn't do anything like that. She is a newbie, this is her first time with a MacBook. She isn't the type to want to change the default icon, or even care to experiment. She has no idea what happened.

Which OS X does she have?  Is she still using HFS+ on the disk?

The same as me (from a corporate image), Catalina. HFS+? Oh no... that is ancient. It's a fairly new Macbook Pro and is likely formatted in APFS (encrypted).

 

Take a look at BlueHarvest. This app will delete unwanted files like Icon? and .DS_Store from your storage devices.
http://zeroonetwenty.com/blueharvest/

Thanks Tom.
It's not a problem with cleaning the hard drive of unwanted files because I can do that with:

find . -name Icon$'\r' -delete

Select allOpen in new window

The problem is understanding what needs to be done to "turn off" whatever is causing these hidden icons.

It appears the files are being created by a custom folder icon, although not sure where it is coming from. I realize the Terminal command will remove them, but since the user is a novice Mac user, installing BlueHarvest will do the removal automatically in the background with no user intervention once configured. I've been a Mac user for over 30 years but avoid Terminal if I can find an app that will do it for me.

Hi Tom,
Because this user needs to continuously create new directories, copy/move files within Finder, the fact that these "Icon?" files keep getting created is going to continue being a problem until I can figure out how to turn it off.

BlueHarvest may be a great tool, but in this situation, it would only be a "bandage" solution. Also, I would need authorization from my IT team to install this 3rd party application. BTW, their solution is to re-image her MacBook. :(   That's why I am here, asking in EE, because our IT team's solution is unacceptable IMHO. There must be an easy fix. 

I really appreciate everyone's help, and also understand the difficulty of solving a problem with only my text descriptions and a single screen capture. But I think that maybe I failed to properly articulate some known facts:
1 - This problem is native to the MacOS. There are no 3rd party tools, plugins, etc. that has modified the OS.
2 - The problem (new "Icon?" files) only occurs when creating, copying, or unzipping files/folders in Finder.
3 - The "Icon?" files can be deleted in terminal, but they re-emerge whenever Finder is used as described in (2).

I am quite surprised that I haven't been able to find a solution that will disable the creation of these files.

It may be that if you are able to use the Terminal commands to clean the entire drive that the problem will go away. It looks as if the custom icon, whatever its original source, is being duplicated over and over again. Are files being copied into the Mac from another source? Are the custom icons being copied in that process? I know it is frustrating, especially with an IT department that likes to take the shotgun approach to solve the problem by reimaging the computer. My IT department is the opposite: They turn and run when they see a Mac, leaving me to deal with it myself.

>> She has no idea what happened.
Understood, maybe just do a check and see whether there was any change made to the default folder icon.
Just to be sure, locate the GenericFolderIcon.icns - this is how I see it (normal folder icon):

Thank you everyone for all your amazing help.

As of this moment, I haven’t had access to this person’s MacBook yet.

I’ll post an update as soon as possible. 

Which version of OS X is she using?  They were probably always there on her system.  Why must you delete them?

It's possible it's the Show Icon Preview option in Finder.  As I don't currently have an older OS X immediately in front of me, I can't tell for sure.  I believe it might be similar to the desktop.ini file in Windows.
 

Hello serialband,

She is on Catalina.

They were probably always there on her system.  Why must you delete them?

No, this is most definitely a condition that did not exist a month ago. It is a problem because when she packages files for automatic consumption by other applications, these hidden files are causing builds to break b/c they are unexpected.

This only began happening a few weeks ago.

Yes, I have a way to periodically delete them, but the point is, we need them to stop these from being created every time she touches a file or folder in Finder. 

Update
I finally had a chance to Zoom with the user.
After some experimenting, the hidden icon files are no longer being created on her local drive. :)  A partial victory, made less appreciated by the fact that I am not certain about the exact steps.

Unfortunately, the hidden icon files are still being created on her mapped Google drive. Disconnecting and re-mapping did not help! This is actually worse than the problem occurring only on her local drive because now I learn that she is affecting the shared content of others. :(

From the terminal, I had her type,

find . -name Icon$'\r' -delete

Select allOpen in new window

And after about 5 minutes, the command removed every hidden icon file from Google Drive. But that isn't a solution because I asked her to create a folder in Google Drive, and that resulted in a new hidden icon file. Hashtag MAD and FRUSTRATED FACE!  

This is truly maddening. There must be a solution. 

This reminds me of a few years ago when we encountered a similar problem with Windows leaving behind those ridiculous desktop.ini files in Google Drive. They too were causing a problem.
But in stark contrast to the MacOS, it took me about 5 minutes of research to find a fix that could be migrated to every Windows computer. The whole fix was completed and migrated in less than 1 hour.

So far, I spent over 4 hours on this MacOS 'icon' issue. :( 

All Mac users should run this following line in Terminal to prevent writing Mac junk to the network shares:
defaults write com.apple.desktopservices DSDontWriteNetworkStores true

It's fine for home users that don't really share their file systems with other people, but this should always be disabled on work systems that connect to work shares with multiple people.

Ok, finally found the old references.  I vaguely remember seeing them long ago, but don't currently have an Old Mac with me to check.  Based on the information, it suggests that she somehow enabled custom icons for her folders.  It's a hidden file with the hidden attribute set on old HFS+ systems.

https://superuser.com/questions/298785/icon-file-on-os-x-desktop
Those Icon? files are actually Icon\r (or Icon^M) files and used to contain the resource fork files of the folders when someone creates a custom Icon for them.

If the files were already created on Google Drive, they won't disappear just by disconnecting.  You still have to manually delete them first.  Turning of the setting doesn't make it remove the files.

Hi serialband,

All Mac users should run this following line in Terminal to prevent writing Mac junk to the network shares:

defaults write com.apple.desktopservices DSDontWriteNetworkStores true

To be clear, this is only a problem on 1 out of over 100 Macbooks.I thought the above command was only for older MacOS.

Also, did you forget "-bool"?, as in:

defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true 

Select allOpen in new window

Based on the information, it suggests that she somehow enabled custom icons for her folders.  It's a hidden file with the hidden attribute set on old HFS+ systems.

I mentioned earlier, that this is a new Macbook and the file system is "Apple_APFS."

If the files were already created on Google Drive, they won't disappear just by disconnecting.  You still have to manually delete them first.  Turning of the setting doesn't make it remove the files.

Yes, I understand that. :) 

FYI,

defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true 

Select allOpen in new window

Did not work, with or without the -bool flag. :( 

I created a short video to demonstrate the problem.

Good demo - very clear - I still don't understand it how the default for a Generic folder has been changed.

Now I did find a little program that works in Catalina where it says that you can change default icons easily: https://freemacsoft.net/liteicon/

Is it possible that the user downloaded a program and changed the default like this? I can't test the program for you but the info says you can revert changes as well with it.

Which OS X is it?  You might need to use

sudo defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true 

Select allOpen in new window

If it's a newer OS, you might need to set your privacy settings to allow you to write to the disk location of the defaults' plist file.

Hi Gerwin Jansen,
>Is it possible that the user downloaded a program and changed the default like this?

100% impossible. Absolutely no additional software was added to this computer after the original package she received. Unless the Google Drive application (a 3rd party application) is doing this, the problem originates with the MacOS.

Ohhhh...I think that's it! It is the Google Drive (File Sync) app that is doing this!  

I even found someone complaining about the same issue.
https://support.google.com/drive/thread/60567835/prevent-backup-sync-from-creating-custom-icons-on-macos-%E2%80%93-subesequent-exfat-backup-fails?hl=en 
 
I understand why it's doing this; Google changes the icon to indicate when the file is synced between the local drive and cloud Google Drive.

The problem is the way MacOS handled this icon flag by creating a single hidden file for every folder instance (seriously ridiculous). Is there a way to change this behavior? Apparently, no one has found a solution.
Incidentally, this is also an easy register fix in Windows  (Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers
 ) - remove all the ones with Google. 


Hi serialband,
I already mentioned that I tried that idea (see one post before the video). Thanks. 

Did you use sudo?  Did you check your Privacy settings?

If those Customized folder Icons come from the Google program, I don't think you can turn them off.  Can your packaging method ignore those hidden flies?

Did you use sudo?  Did you check your Privacy settings?

Yes, but that command will not affect the behavior of the Google Drive Sync app. :(

If those Customized folder Icons come from the Google program, I don't think you can turn them off.  Can your packaging method ignore those hidden flies?

If the Icon\r didn't have an escape character then, yes. For some bizarre reason, Apple has to do something different The escape character in the file name is being interpreted as corruption. I think my only option is to write a bash script to pre-process the folders before a packaging operation.

Thank you all. I really appreciate all your efforts.