8

I'm running Mavericks with Chrome, and when I download an image/file it saves the 'Where from' when viewing via Get Info. This also happens in Safari.

Now, I understand there is a separate download history which can be viewed and deleted via the the tricks in the following article: http://www.cultofmac.com/179873/list-your-macs-entire-download-history-at-once-os-x-tips/ These are used when opening Applications for the first time to show the user where they come from.

However, I've deleted this and confirm it's empty but yet it still shows in the 'Where from.' I've done some further tests and uploaded the image to view the EXIF and meta data but it doesn't appear to be stored in the files meta data at all. So where could it be stored?

Does anyone know how this 'Where from' meta data is stored, and where it is stored. Does it stay with the file if you put the file on the USB drive and open on a different computer?

I'm not so much worried about removing it, but I just can't see where it comes from?

15

It's stored in an extended attribute on the file. Specifically the com.apple.metadata:kMDItemWhereFroms attribute. It may stay with the file when you move it to different computers, but it depends on the filesystem or file sharing protocol you use. If you move it to another Mac on an HFS+ disk, it will likely keep it, but not necessarily if you transfer over the network, and most likely not with an external disk with a non-HFS+ filesystem.

You can check a file by running xattr -lp com.apple.metadata:kMDItemWhereFroms myfile in the Terminal, or remove it with xattr -d com.apple.metadata:kMDItemWhereFroms my file. ls -l@ flag is also useful; it will list the names of xattrs along with the usual ls information.

If you want to remove it from multiple files, have a look at this question: How to remove xattr com.apple.quarantine from all .webarchive files with that extended attribute?

  • That's a very informative answer, thank you. Would I be correct in saying that the file is contains the file data, and then there is a hidden shell file which actually has the xattr added to it? – Jamie Bicknell Nov 11 '13 at 23:18
  • Close, but not exactly. It's more akin to metadata. The same way a file has contents that are the actual data, but also a name, creation date, and so forth, it can have extended attributes attached. – robmathers Nov 11 '13 at 23:21
  • @robmathers: dang, you've beat me to it. Also I forgot about the -l option of xattr. Have an upvote. – Asmus Nov 11 '13 at 23:25
5

There are extended attributes assigned to downloaded files, like com.apple.quarantine to put executable files in quarantine and com.apple.metadata:kMDItemWhereFroms for the "Where from" data. The presence of these attributes can be revealed in the Terminal via ls -l@ /path/to/downloaded/file.

Now to get the actual Data stored in this kMDItemWhereFroms, I found a solution based on this answer (which also explains a bit more about the conversion method):

xattr -p com.apple.metadata:kMDItemWhereFroms /path/to/downloaded/file | sed -e 's/0D//g' -e 's/.*\(5F 10\)...//' -e 's/00.*//'| xxd -r -p | sed -e 's@ (.*@@g'

This will return the url. Please note that at this moment it's in a relatively hard to read form, since my command-line-fu seems to fail me. I'll update the answer once I found the proper sed for it.

  • 3
    From the first few bytes, "bplist", I guessed it was a binary plist, so here's how to decode it using Apple's tools for reading those: xattr -p com.apple.metadata:kMDItemWhereFroms "$file" | xxd -r -p | plutil -convert xml1 -o - -. If you want to get the URL(s) (most files seem to have two) out on their own, the proper thing to use at this point would be either some general XML tool (like xpath) or some plist-specific tool (can't help you there). (Tested on 10.8.5.) – Aaron Davies Feb 7 '15 at 22:08
  • @AaronDavies you're correct! Unfortunately, the strings do not seem to be in a specific order within the XML. It's nice to see that this works on things like Mail attachments too. – Asmus Feb 10 '15 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .