15

I'm running Mavericks with Chrome, and when I download an image/file it saves the 'Where from' when viewing via Get Info. This also happens in Safari.

Now, I understand there is a separate download history which can be viewed and deleted via the the tricks in the following article: http://www.cultofmac.com/179873/list-your-macs-entire-download-history-at-once-os-x-tips/ These are used when opening Applications for the first time to show the user where they come from.

However, I've deleted this and confirm it's empty but yet it still shows in the 'Where from.' I've done some further tests and uploaded the image to view the EXIF and meta data but it doesn't appear to be stored in the files meta data at all. So where could it be stored?

Does anyone know how this 'Where from' meta data is stored, and where it is stored. Does it stay with the file if you put the file on the USB drive and open on a different computer?

I'm not so much worried about removing it, but I just can't see where it comes from?

Improve this question
1
  • do you fancy a programmatic answer too, showing how to retrieve this information for a file? I see you confirmed the answer that explains it "shell level"...
    – Motti Shneor
    Dec 31, 2020 at 6:31

2 Answers 2

Reset to default
22

It's stored in an extended attribute on the file. Specifically the com.apple.metadata:kMDItemWhereFroms attribute. It may stay with the file when you move it to different computers, but it depends on the filesystem or file sharing protocol you use. If you move it to another Mac on an HFS+ disk, it will likely keep it, but not necessarily if you transfer over the network, and most likely not with an external disk with a non-HFS+ filesystem.

You can check a file by running xattr -lp com.apple.metadata:kMDItemWhereFroms myfile in the Terminal, or remove it with xattr -d com.apple.metadata:kMDItemWhereFroms my file. ls -l@ flag is also useful; it will list the names of xattrs along with the usual ls information.

If you want to remove it from multiple files, have a look at this question: How to remove xattr com.apple.quarantine from all .webarchive files with that extended attribute?

Improve this answer
4
  • That's a very informative answer, thank you. Would I be correct in saying that the file is contains the file data, and then there is a hidden shell file which actually has the xattr added to it?
    – Jamie Bicknell
    Nov 11, 2013 at 23:18
  • Close, but not exactly. It's more akin to metadata. The same way a file has contents that are the actual data, but also a name, creation date, and so forth, it can have extended attributes attached.
    – robmathers
    Nov 11, 2013 at 23:21
  • @robmathers: dang, you've beat me to it. Also I forgot about the -l option of xattr. Have an upvote.
    – Asmus
    Nov 11, 2013 at 23:25
  • absolutely not a "hidden shell file" Metadata storage, indexing, search and retrieval are a big subject, that's not very easy to encompass or understand. Just remember Spotlight feature relies on this Metadata (and collects it) and there are special components you can develop for your app that will return your own custom metadata for your custom document files (dynamically called by the OS) and there is the actual File-System supported metadata attributes, and more.
    – Motti Shneor
    Dec 31, 2020 at 6:28
9

There are extended attributes assigned to downloaded files, like com.apple.quarantine to put executable files in quarantine and com.apple.metadata:kMDItemWhereFroms for the "Where from" data. The presence of these attributes can be revealed in the Terminal via ls -l@ /path/to/downloaded/file.

Now to get the actual Data stored in this kMDItemWhereFroms, I found a solution based on this answer (which also explains a bit more about the conversion method):

xattr -p com.apple.metadata:kMDItemWhereFroms /path/to/downloaded/file | sed -e 's/0D//g' -e 's/.*\(5F 10\)...//' -e 's/00.*//'| xxd -r -p | sed -e 's@ (.*@@g'

This will return the url. Please note that at this moment it's in a relatively hard to read form, since my command-line-fu seems to fail me. I'll update the answer once I found the proper sed for it.

Improve this answer
3
  • 8
    From the first few bytes, "bplist", I guessed it was a binary plist, so here's how to decode it using Apple's tools for reading those: xattr -p com.apple.metadata:kMDItemWhereFroms "$file" | xxd -r -p | plutil -convert xml1 -o - -. If you want to get the URL(s) (most files seem to have two) out on their own, the proper thing to use at this point would be either some general XML tool (like xpath) or some plist-specific tool (can't help you there). (Tested on 10.8.5.)
    – Aaron Davies
    Feb 7, 2015 at 22:08
  • @AaronDavies you're correct! Unfortunately, the strings do not seem to be in a specific order within the XML. It's nice to see that this works on things like Mail attachments too.
    – Asmus
    Feb 10, 2015 at 19:57
  • @AaronDavies: I found xattr -p com.apple.metadata:kMDItemWhereFroms "$1" | xxd -r -p | plutil -p - | grep -w 0 | grep -o 'http[^"]*' is a shorter way of getting the first (0'th) of the two URLs.
    – smci
    Jul 24 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .