5 ms·
No, MacOS stores the origin of the file. Downloaded with Safari: $ xattr -l Downloads/Ethiopian_Airlines_ET-AVJ_takeoff_from_TLV_\(46461974574\).jpg
by darkpuma 8y ago
No, MacOS stores the origin of the file. Downloaded with Safari:
$ xattr -l Downloads/Ethiopian_Airlines_ET-AVJ_takeoff_from_TLV_\(46461974574\).jpg
com.apple.lastuseddate#PS:
00000000 D9 76 8A 5C 00 00 00 00 9F E5 89 0D 00 00 00 00 |.v..............|
00000010
com.apple.metadata:kMDItemDownloadedDate:
00000000 62 70 6C 69 73 74 30 30 A1 01 33 41 C1 1D 57 2B |bplist00..3A..W+|
00000010 FF B1 3A 08 0A 00 00 00 00 00 00 01 01 00 00 00 |..:.............|
00000020 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 13 |.....|
00000035
com.apple.metadata:kMDItemWhereFroms:
00000000 62 70 6C 69 73 74 30 30 A2 01 02 5F 10 7D 68 74 |bplist00..._.}ht|
00000010 74 70 73 3A 2F 2F 75 70 6C 6F 61 64 2E 77 69 6B |tps://upload.wik|
00000020 69 6D 65 64 69 61 2E 6F 72 67 2F 77 69 6B 69 70 |imedia.org/wikip|
00000030 65 64 69 61 2F 63 6F 6D 6D 6F 6E 73 2F 64 2F 64 |edia/commons/d/d|
00000040 32 2F 45 74 68 69 6F 70 69 61 6E 5F 41 69 72 6C |2/Ethiopian_Airl|
00000050 69 6E 65 73 5F 45 54 2D 41 56 4A 5F 74 61 6B 65 |ines_ET-AVJ_take|
00000060 6F 66 66 5F 66 72 6F 6D 5F 54 4C 56 5F 25 32 38 |off_from_TLV_%28|
00000070 34 36 34 36 31 39 37 34 35 37 34 25 32 39 2E 6A |46461974574%29.j|
00000080 70 67 3F 64 6F 77 6E 6C 6F 61 64 5F 10 19 68 74 |pg?download_..ht|
00000090 74 70 73 3A 2F 2F 65 6E 2E 77 69 6B 69 70 65 64 |tps://en.wikiped|
000000A0 69 61 2E 6F 72 67 2F 08 0B 8B 00 00 00 00 00 00 |ia.org/.........|
000000B0 01 01 00 00 00 00 00 00 00 03 00 00 00 00 00 00 |................|
000000C0 00 00 00 00 00 00 00 00 00 A7 |..........|
000000ca
com.apple.quarantine: 0083;5c8a76d8;Safari;ADF309D2-762B-4FE2-AEC6-104E019BDBF9
- jiripospisil 8y agoAdditionally, the same information is stored in an SQLite database in your home directory. In fact, the ID at the very end of the output is the primary key to the table: sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 "select * from LSQuarantineEvent where LSQuarantineEventIdentifier = 'ADF309D2-762B-4FE2-AEC6-104E019BDBF9'" The entry in the table also doesn't seem to be deleted when you delete the downloaded file. That is, you can get a list of all files you've ever downloaded: sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 "select * from LSQuarantineEvent"
- mthoms 8y agoHmmm, I'm not seeing any entries in that table from Safari (my primary browser). I am seeing all the Hombrew Cask downloads, iChat (messages) and a couple Firefox and Brave based downloads.
- darkpuma 8y ago> select LSQuarantineDataURLString from LSQuarantineEvent where LSQuarantineAgentName = 'Safari'; https://upload.wikimedia.org/wikipedia/commons/d/d2/Ethiopian_Airlines_ET-AVJ_takeoff_from_TLV_%2846461974574%29.jpg?download Maybe you've got Safari configured in some way that prevents it, but with the default configuration, Safari definitely gets entries in that db.