Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

List Full Download History of Your Mac System
Mac OS X's quarantine feature not only sets a special quarantine bit on files you download - so it can alert you the first time you open them, and so its built-it anti-malware feature can scan for certain threats - but it also keeps a list of the files you have downloaded. OS X Daily pointed out the command you can run in Terminal to see the full list of these downloads. Run this command:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'
The resulting text includes a lot of blank lines, so you might want to sort them to better view them:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent' | sort
To delete this history - which is a good idea to do from time to time for privacy reasons - run this command:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'delete from LSQuarantineEvent'
[kirkmc adds: Note that, as a commenter mentions below, this won't be every file you've downloaded, but those files you downloaded with applications that set the quarantine bit.]
    •    
  • Currently 4.14 / 5
  You rated: 1 / 5 (7 votes cast)
 
[11,803 views]  

List Full Download History of Your Mac | 12 comments | Create New Account
Click here to return to the 'List Full Download History of Your Mac ' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
List Full Download History of Your Mac
Authored by: mbroughtn on Jul 17, '12 08:36:14AM

Not every file you download will have the quarantine xattr set. Files downloaded with Safari have that characteristic. Files downloaded with other browsers will probably not have the quarantine bit set.



[ Reply to This | # ]
List Full Download History of Your Mac
Authored by: leamanc on Jul 18, '12 12:42:39PM

The quarantine is a bit set on the Downloads folder (probably others too, like Desktop). So as long as you download to Downloads, it shouldn't matter what browser you use. I use Chrome 99% of the time, and the command showed plenty of downloads that I recognized as coming from that browser.



[ Reply to This | # ]
List Full Download History of Your Mac
Authored by: mbroughtn on Jul 19, '12 04:54:20PM

I am not sure how you are determining there is an quarantine xattr for Desktop or Download. I do see an ACL for the standard User directories to prevent them from being deleted, but no xattr -- quarantine or other.

I did some more testing and have had mixed results as to what application will add the quarantine xattr for downloads. When I use Safari, Camino, Firefox, Chrome, or Cyberduck (ftp client), the downloads will have the quarantine xattr. If I use iCab (browser) or Transmit (ftp), the downloads do not have a quarantine xattr.

I think you will also find that if you have downloaded a file and cleared the quarantine bit using Apple's dialog window, you can download the same file again and the quarantine bit will not be set. I did not test this in any detail, however.

The bottom line is to not totally rely on the quarantine bit being set for a download.



[ Reply to This | # ]
Re: List Full Download History of Your Mac
Authored by: Uncle Asad on Jul 20, '12 02:34:42PM

Specifically, some applications opt-in to quarantining via a key in their Info.plist, but Apple also includes in the OS a plist containing bundle identifiers of some applications (just common web browsers, last I checked) whose downloads the quarantine system automatically quarantines regardless of whether the application has opted-in itself.

So if you download files with command-line tools like curl or wget or a with third-party application that isn't on Apple's list and hasn't opted-in to quarantining, then those files won't be quarantined (and won't be included in this database).



[ Reply to This | # ]
List Full Download History of Your Mac
Authored by: metiure on Jul 17, '12 09:22:01AM

"SQL error: no such table: LSQuarantineEvent"

Is this a 10.7/10.8 only hint? Doesn't seem to work on 10.6



[ Reply to This | # ]
List Full Download History of Your Mac
Authored by: aaronrp on Jul 17, '12 10:43:03AM
It works in 10.6 if you change it slightly, removing the "V*"

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents 'select LSQuarantineDataURLString from LSQuarantineEvent'
If you add | uniq after the end, it will present them un-sorted, but with duplicate lines removed (which, in effect, removes all the duplicate blank lines).

[ Reply to This | # ]
Grep or distinct to filter blank lines
Authored by: lullabud on Jul 17, '12 10:58:36AM
I used grep -v '^$' at the end to filter the blanks. Using uniq didn't seem to work. Using select distinct also works.

[ Reply to This | # ]
Grep or distinct to filter blank lines
Authored by: morespace54 on Jul 17, '12 12:28:31PM
Great tip (and the grep bit is a great addition)!
Now I can only wish Apple will keep the Terminal app for a long, long time (I would hate to see it disappear just because 'Average users can screw their computer with it' and because iOS doesn't have such a fine app)...

[ Reply to This | # ]
Grep or distinct to filter blank lines
Authored by: fracai on Jul 19, '12 07:10:33PM
uniq requires the duplicate lines to be consecutive. Otherwise they aren't removed. Another option is sort -u, but that will reorder the list. You could get complicated by printing the date column as well, then radix sort, uniquely on the URL column, and then non-uniquely by the date column.
---
i am jack's amusing sig file


[ Reply to This | # ]
List Full Download History of Your Mac
Authored by: hamarkus on Jul 17, '12 03:37:09PM

Any idea when this database was first created? I would guess when this 'downloaded bit' was first introduced, ie, with Leopard. But it quite likely might have had its form changed along the way and thus the current version might be much younger (and thus go not back that far).



[ Reply to This | # ]
Re: List Full Download History of Your Mac
Authored by: Uncle Asad on Jul 18, '12 02:02:06PM
On 10.5.8, appending | wc -l to the sqlite3 command gives me 10532; I'm certain I've downloaded more than 10K items in LSFileQuarantineEnabled applications since fall of 2007. So the db must roll over/be purged periodically even within major versions, regardless of what the across-OS-versions behavior is.

[ Reply to This | # ]
List Full Download History of Your Mac
Authored by: fracai on Jul 19, '12 07:12:16PM

There are other columns in the database and one of them looks to be a unix time stamp (seconds from the epoch). I already blew mine away, but you could print the whole table and look at that field.

---
i am jack's amusing sig file



[ Reply to This | # ]