4 ms·

If you're concerned about artifacts being left around, then you should also know that there is a log file of every file you've ever downloaded, including in pri

by feelix 10y ago

If you're concerned about artifacts being left around, then you should also know that there is a log file of every file you've ever downloaded, including in private browsing mode. You can see it with this: https://macdaddy.io/cleandisk/ https://macdaddy.io/cleandisk/

skissane 10y ago
Today I learned that $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 is a sqlite database. The LSQuarantineEvent table contains every file you ever downloaded, the source URL is in the LSQuarantineDataURLString column. sqlite3 $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'select LSQuarantineDataURLString from LSQuarantineEvent' sqlite3 $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'delete from LSQuarantineEvent'
- petrikapu 10y ago
  Select gives me 22 rows. I'm pretty sure I've download much more. Maybe per session?
  - feelix 10y ago
    No, it's permanent. Try the app and I think you'll see a longer history.
  - skissane 10y ago
    I saw stuff in there I downloaded days or maybe even weeks ago. (Couldn't tell you exactly when since I've deleted it all now.) I've heard reports of people seeing downloads from years ago. Here is a SQL to view timestamps: SELECT datetime(LSQuarantineTimeStamp + 978307200, "unixepoch", "localtime") as LSQuarantineTimeStamp from LSQuarantineEvent (Based on http://www.forensicswiki.org/wiki/Mac_OS_X http://www.forensicswiki.org/wiki/Mac_OS_X with modification.) In my testing, only downloads from Safari are logged here, not those from Firefox (haven't tested Chrome). If you don't use Safari as your primary browser, that might explain not seeing many downloads.
- Udo_Schmitz 10y ago
  Interesting. But I see only fairly old stuff there. And I'd guess only downloads from a single day or week a few years ago.
- justinclift 10y ago
  It's directly loadable using a GUI too (eg sqlitebrowser.org), for anyone that prefers the graphical approach. And yeah, it had all kinds of interesting stuff I've downloaded over the years in mine. Now cleared. ;)
Udo_Schmitz 10y ago
Won't even start without admin password, I'll pass.

by feelix 10y ago

skissane 10y ago

Today I learned that $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 is a sqlite database. The LSQuarantineEvent table contains every file you ever downloaded, the source URL is in the LSQuarantineDataURLString column. sqlite3 $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'select LSQuarantineDataURLString from LSQuarantineEvent' sqlite3 $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'delete from LSQuarantineEvent'

petrikapu 10y ago
Select gives me 22 rows. I'm pretty sure I've download much more. Maybe per session?
- feelix 10y ago
  No, it's permanent. Try the app and I think you'll see a longer history.
- skissane 10y ago
  I saw stuff in there I downloaded days or maybe even weeks ago. (Couldn't tell you exactly when since I've deleted it all now.) I've heard reports of people seeing downloads from years ago. Here is a SQL to view timestamps: SELECT datetime(LSQuarantineTimeStamp + 978307200, "unixepoch", "localtime") as LSQuarantineTimeStamp from LSQuarantineEvent (Based on http://www.forensicswiki.org/wiki/Mac_OS_X http://www.forensicswiki.org/wiki/Mac_OS_X with modification.) In my testing, only downloads from Safari are logged here, not those from Firefox (haven't tested Chrome). If you don't use Safari as your primary browser, that might explain not seeing many downloads.
Udo_Schmitz 10y ago
Interesting. But I see only fairly old stuff there. And I'd guess only downloads from a single day or week a few years ago.
justinclift 10y ago
It's directly loadable using a GUI too (eg sqlitebrowser.org), for anyone that prefers the graphical approach. And yeah, it had all kinds of interesting stuff I've downloaded over the years in mine. Now cleared. ;)

Udo_Schmitz 10y ago

Won't even start without admin password, I'll pass.