Finder Color Tags Weren't AI — Just a "Red\n6" String in an xattr

I was checking whether I could find scenes like "someone smiling" among about 5,500 photos and videos synced to OneDrive, and noticed around 300 of them had tags. I assumed iPhone or OneDrive had added AI tags.

They were all color tags I had added myself in Finder. The "tags" on local files are mostly color labels added by people. AI tags describing what's in a photo aren't in the file at all. Here's where tags actually live and how to tell who added them.

Tags live in xattrs, not in the file content

An xattr (extended attribute) is a "name = value" note attached to a file, separate from its content. Finder tags leave traces in two of them.

com.apple.metadata:_kMDItemUserTags holds the tag list as a binary plist array. Each tag is a string shaped "name\ncolor number". Red added on a Korean-language macOS is "빨간색\n6"; red added on a Japanese one is "レッド\n6". Color numbers: 0 none, 1 gray, 2 green, 3 purple, 4 blue, 5 yellow, 6 red, 7 orange.

com.apple.FinderInfo stores the old-style label color in 3 bits of one byte. It holds a single color. Add several tags and this field still keeps only the last one.

To look for yourself:

xattr -l photo.jpg
xattr -px com.apple.metadata:_kMDItemUserTags photo.jpg | xxd -r -p | plutil -p -

The second line decodes the binary plist into an array. On a test file with two tags it printed 0 => "Red with 6" on the next line: the newline inside the string comes out as is. mdls -name kMDItemUserTags also exists, but in a folder Spotlight doesn't index (like /tmp) it printed (null).

Who added them

Candidate	Verdict	Why
iPhone Photos	no	People and scene recognition stays in the Photos library database. It isn't written to exported files as Finder tags
OneDrive auto tags	not locally	Tag names were the stock macOS color names. Nothing described the content
A person in Finder	yes	The name-plus-color-number format, and two languages mixed

The language settled it. One trip folder had レッド, another had 빨간색. They were tagged in two environments with different system languages. Many photos also had 2 to 4 colors stacked, which looks like someone gave each color a meaning. I just didn't remember doing it.

Numbers (2026-09-26)

Out of about 14,900 files in the OneDrive folder, photos and videos were jpg 4,407 / heic 1,341 / png 1,305 / mov 358 / mp4 60. About 300 files had _kMDItemUserTags, all color tags. IPTC/XMP keywords (kMDItemKeywords): zero. The 191 files with comments weren't photos but things like PDFs made by Google.

So a search like "smiling photos" can't be done from local metadata.

Three kinds of tag, three places

Kind	Where	When the file moves
Finder color tag	the file's xattr	only with copies that preserve xattrs
IPTC / XMP keywords	inside the file content	travel with the file
service AI tags	Photos or OneDrive servers	stay behind

If you want to search by content, don't lean on color tags. Generate descriptions with a local image model instead. That's the next experiment.

Not checked yet: whether OneDrive carries Finder tags to another Mac, and whether mdfind for 빨간색 also matches レッド. Also, xattrs don't record when a tag was added, so there's no way to know when I did it.

If you're working on making thousands of photos or documents searchable by what's in them, talk to us at https://www.negabaro.com/contact.