Show Download History List of All Files Ever Downloaded Within Mac OS X

Jul 12, 2012 - 29 Comments

List Download History of All Files on a Mac

Have you ever wanted to show a list of the entire download history of a Mac? Maybe you know you downloaded a file but you can’t quite pinpoint where you got it from and the “Get Info” trick didn’t work. Or maybe you are trying to track down a file that has been placed on a system that led to problems. Whether it’s for troubleshooting, personal interest, or forensics, the following command will show you everything that you’ve downloaded to a Mac regardless of the application that it came from:

  • Launch Terminal from /Applications/Utilities/ and enter the following command into a single line:

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'

Depending on how old the Mac is and how much stuff you’ve downloaded, it can take a while to query the database and dump the results. You may want to pipe the results through “sort” to group the downloaded list into similar items or sources, that would look like this:

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent' | sort

The output lists everything that has been passed through the Quarantine Manager, which for the last several versions of Mac OS X is quite literally every item downloaded to the Mac, regardless of the application it came from. The older the Mac is, the larger the list, and the longer the query can take to run.

This list even works if you have file quarantine turned off for files and apps, thanks to inket for verifying that.

Deleting the Download History List

For those who would rather not have an all-inclusive historical list of downloaded files, you can run the following command to delete the contents of the quarantine database:

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'delete from LSQuarantineEvent'

You can run that individually, or place it into .bash_profile or .profile to clear the database automatically when a new terminal window is launched.

Thanks to Scott for the great tip, and thanks to Wiggums for the delete syntax

Enjoy this tip? Subscribe to the OSXDaily newsletter to get more of our great Apple tips, tricks, and important news delivered to your inbox! Enter your email address below:

Related articles:

Posted by: William Pearson in Command Line, Mac OS X, Tips & Tricks, Troubleshooting

29 Comments

» Comments RSS Feed

  1. hi says:

    Yep, worked on mine.
    How can we erase this history ?

  2. Wiggums says:

    Hi folks, to truncate the db do this:

    sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘delete from LSQuarantineEvent’

    In fact, for privacy put it in your ~/.profile.

  3. Jim says:

    Mine just says:
    Error: no such table: LSQuarantineEvent

    Not sure if it matters, but I am logged in as a regular user. I tried “su adminusername” but it still didn’t work. I have the File Quarantine warning showing. ??
    I’m running Snow Leopard, if that makes any difference.

  4. inket says:

    My file quarantine is off, yet I have this history with all the downloads since I installed Lion.

  5. Kevin says:

    Wow, good thing my wife doesn’t know a thing about the terminal!

    ;)

  6. Michael says:

    Matt if you did a copy & paste, you got smart quotes around the delete command. Just replace these a standard quote:

    sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘delete from LSQuarantineEvent’

    or manually type the complete command.

  7. My QuarantineEventsV* file was empty on my 10.6.8 systems. The table and entries were in QuarantineEvents. SO I just adjusted the command line accordingly and now that stuff is gone.

  8. John R says:

    None of these commands work. iMac 10.6.8

    • TR says:

      the following works in 10.6.8
      Just needed a bit of fiddling or you get the error about no such table or one about a syntax error at “/”.

      sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents ‘select LSQuarantineDataURLString from LSQuarantineEvent’

      The important bits are to get rid of the V*. I tried * w/out the V but that didn’t work either. Without that it works fine. Not a long list for me; but I did do a delete, modify that command as above and it works as well.

  9. Max says:

    Now tell me how to clear this list with pr0n that I download recently :D

  10. clod says:

    none of these work;

    Error: no such table: LSQuarantineEvent

    Error: too many options: “LSQuarantineDataURLString”

    Error: too many options: “select LSQuarantineDataURLString from LSQuarantineEvent”

    I tried every possible syntax, without the V, *, single quotes, double quotes…etc.

    Doesn’t work. 10.6.8
    the file “com.apple.LaunchServices.QuarantineEvents” is there though…

  11. clod says:

    can one delete this file altogether?

  12. clod says:

    just delete the whole thing … launchservice makes a new one as soon as you download something else.

    If you’ve disabled Quarantine as I have (defaults write com.apple.LaunchServices LSQuarantine -bool NO)

    You can lock the file (via the Get Info window) to prevent further writing to it if you don’t like the idea of your OS logging your dowloads.

    You can use Base or another SQL editor if you simply want to edit the file…

    Cheers!

  13. Loz says:

    I dont like the idea of MAC saving a list of all my downloads,
    I would like to either disable this option or as the article says to delete the list on start up using the .profile or .bash_profile – however after spending a few minutes searching via the terminal im unable to find either of those files mentioned. can anyone shed any advice for a novice MAC user?.

    Thank you.

    Loz!

  14. David says:

    mmm. I get permission denied. I’m logged in as admin

    David

  15. John says:

    I get nothing when I enter the commands above, but using the sudo addon I get

    WARNING: Improper use of the sudo command could lead to data loss
    or the deletion of important system files. Please double-check your
    typing when using sudo. Type “man sudo” for more information.

    To proceed, enter your password, or type Ctrl-C to abort.

    I can find the QuarantineEvents and QuarantineEventsV2 files, but they all have the same two dates, March 2008 and May 2012. When I open them with textEdit it appears to contain only emails. Searching them reveals no mp3 or txt or other media files, no dmg etc.

    • FYI says:

      It’s a SQL database, not a txt file. Using the sudo command for the first time always issues a warning about its use.

  16. pret says:

    You can turn this off with this defaults command

    defaults write com.apple.LaunchServices LSQuarantine -bool NO

  17. r_x says:

    hi all,
    i’m a completely noob with terminal, but would love to explore this a bit more, any idea on how to get date and file size?

    thanx in advance!
    .r

  18. Melmahey says:

    This is most AWESOME. I research so much stuff, I forget what I’ve downloaded. This is a great way for me to go back to files I needed and re-use them. Sweet.

    This data is used by the ‘info’ command on files that were downloaded, so if you delete everything the ‘info’ command won’t tell you where you got the file from originally.

    For me, that”s important. I grab example code snippets, standards docs, references, xls’s of proforma biz, all manner of great downloads. Now I can find the files i downloaded and grab the latest versions.

    I promise I’ll be better organized next deadline driving, time constrained project! :)

  19. Bill Cole says:

    The article is incorrect in its description of the scope of what the “Quarantine Manager” sees and records in the QuarantineEvents database(s). Most of Apple’s own apps (but notably NOT the FTP-as-disk functionality of Finder) use it and so does Google Chrome, but based on a dump of the 15k records (mostly from Mail.app) on my Mac it is clear that Firefox, Thunderbird, MailMate, and NetNewsWire do not and Transmission (a BitTorrent client) seems to only use it for its self-update function. Command-line tools (e.g. curl, wget, etc.) also do not show up.

  20. John Robinson says:

    Error: no such table: LSQuarantineEvent

    I’ve tried all different ways and nothing of this hint works in 10.8.2 on an iMac 27″.

Leave a Reply

 

Shop for Apple & Mac Deals on Amazon.com

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates