Show Download History List of All Files Ever Downloaded Within Mac OS X

Jul 12, 2012 - 37 Comments

List Download History of All Files on a Mac

Have you ever wanted to show a list of the entire download history of a Mac? Maybe you know you downloaded a file but you can’t quite pinpoint where you got it from and the “Get Info” trick didn’t work. Or maybe you are trying to track down a file that has been placed on a system that led to problems. Whether it’s for troubleshooting, personal interest, or forensics, the following command will show you everything that you’ve downloaded to a Mac regardless of the application that it came from:

How to View a List of All Files Downloaded to a Mac

This works by querying the file quarantine database of OS X, which is aimed at protecting Macs from malicious downloads. You’ll use the Terminal application and sqlite for this purpose.

  • Launch Terminal from /Applications/Utilities/ and enter the following command into a single line:
  • sqlite3 ~/Library/Preferences/* 'select LSQuarantineDataURLString from LSQuarantineEvent'

  • Hit return to see the list of downloaded files

Depending on how old the Mac is and how much stuff you’ve downloaded, it can take a while to query the database and dump the results. You may want to pipe the results through “sort” to group the downloaded list into similar items or sources, that would look like this:

sqlite3 ~/Library/Preferences/* 'select LSQuarantineDataURLString from LSQuarantineEvent' | sort

For ease of viewing, you can also redirect the output into a text file, this command will dump the list into a file called “QuarantineEventList.txt” on the active users desktop:

sqlite3 ~/Library/Preferences/* 'select LSQuarantineDataURLString from LSQuarantineEvent' > ~/Desktop/QuarantineEventList.txt

The output lists everything that has been passed through the Quarantine Manager, which for the last several versions of Mac OS X is quite literally every item downloaded to the Mac, regardless of the application it came from. Generally, the older the Mac is and the more files have been downloaded, the larger the list, and the longer the query can take to run.

This list even works if you have file quarantine turned off for files and apps, thanks to inket for verifying that.

Deleting the Download History List

For those who would rather not have an all-inclusive historical list of downloaded files, you can run the following command to delete the contents of the quarantine database:

sqlite3 ~/Library/Preferences/* 'delete from LSQuarantineEvent'

You can run that individually, or place it into .bash_profile or .profile to clear the database automatically when a new terminal window is launched.

This has been tested and continues to work in many versions of Mac OS X, from earlier versions through to OS X El Capitan (10.11.x+), OS X Yosemite, OS X Mavericks 10.9.5 and presumably newer. Let us know in the comments if you have success with this command and the version of OS X that you have used it with.

Thanks to Scott for the great tip, and thanks to Wiggums for the delete syntax.


Related articles:

Posted by: William Pearson in Command Line, Mac OS, Tips & Tricks, Troubleshooting


» Comments RSS Feed

  1. Anonymous says:

    I’m amazed by how far back this goes but I don’t think it has everything because I’m trying to find the name of a game I downloaded a year ago, but it doesn’t show any downloads from game sites.

  2. Daniel says:

    I am running Big Sur and Monterey on my new iMac and this code in Terminal is working fine. Thank you

  3. GP says:

    Hey, commands don’t work in Yosemite. Is there an updated version?

  4. John Robinson says:

    Error: no such table: LSQuarantineEvent

    I’ve tried all different ways and nothing of this hint works in 10.8.2 on an iMac 27″.

  5. Bill Cole says:

    The article is incorrect in its description of the scope of what the “Quarantine Manager” sees and records in the QuarantineEvents database(s). Most of Apple’s own apps (but notably NOT the FTP-as-disk functionality of Finder) use it and so does Google Chrome, but based on a dump of the 15k records (mostly from on my Mac it is clear that Firefox, Thunderbird, MailMate, and NetNewsWire do not and Transmission (a BitTorrent client) seems to only use it for its self-update function. Command-line tools (e.g. curl, wget, etc.) also do not show up.

  6. Melmahey says:

    This is most AWESOME. I research so much stuff, I forget what I’ve downloaded. This is a great way for me to go back to files I needed and re-use them. Sweet.

    This data is used by the ‘info’ command on files that were downloaded, so if you delete everything the ‘info’ command won’t tell you where you got the file from originally.

    For me, that”s important. I grab example code snippets, standards docs, references, xls’s of proforma biz, all manner of great downloads. Now I can find the files i downloaded and grab the latest versions.

    I promise I’ll be better organized next deadline driving, time constrained project! :)

  7. r_x says:

    hi all,
    i’m a completely noob with terminal, but would love to explore this a bit more, any idea on how to get date and file size?

    thanx in advance!

  8. pret says:

    You can turn this off with this defaults command

    defaults write LSQuarantine -bool NO

  9. John says:

    I get nothing when I enter the commands above, but using the sudo addon I get

    WARNING: Improper use of the sudo command could lead to data loss
    or the deletion of important system files. Please double-check your
    typing when using sudo. Type “man sudo” for more information.

    To proceed, enter your password, or type Ctrl-C to abort.

    I can find the QuarantineEvents and QuarantineEventsV2 files, but they all have the same two dates, March 2008 and May 2012. When I open them with textEdit it appears to contain only emails. Searching them reveals no mp3 or txt or other media files, no dmg etc.

    • FYI says:

      It’s a SQL database, not a txt file. Using the sudo command for the first time always issues a warning about its use.

  10. David says:

    mmm. I get permission denied. I’m logged in as admin


  11. Loz says:

    I dont like the idea of MAC saving a list of all my downloads,
    I would like to either disable this option or as the article says to delete the list on start up using the .profile or .bash_profile – however after spending a few minutes searching via the terminal im unable to find either of those files mentioned. can anyone shed any advice for a novice MAC user?.

    Thank you.


  12. clod says:

    just delete the whole thing … launchservice makes a new one as soon as you download something else.

    If you’ve disabled Quarantine as I have (defaults write LSQuarantine -bool NO)

    You can lock the file (via the Get Info window) to prevent further writing to it if you don’t like the idea of your OS logging your dowloads.

    You can use Base or another SQL editor if you simply want to edit the file…


  13. clod says:

    can one delete this file altogether?

  14. clod says:

    none of these work;

    Error: no such table: LSQuarantineEvent

    Error: too many options: “LSQuarantineDataURLString”

    Error: too many options: “select LSQuarantineDataURLString from LSQuarantineEvent”

    I tried every possible syntax, without the V, *, single quotes, double quotes…etc.

    Doesn’t work. 10.6.8
    the file “” is there though…

  15. Max says:

    Now tell me how to clear this list with pr0n that I download recently :D

  16. John R says:

    None of these commands work. iMac 10.6.8

    • TR says:

      the following works in 10.6.8
      Just needed a bit of fiddling or you get the error about no such table or one about a syntax error at “/”.

      sqlite3 ~/Library/Preferences/ ‘select LSQuarantineDataURLString from LSQuarantineEvent’

      The important bits are to get rid of the V*. I tried * w/out the V but that didn’t work either. Without that it works fine. Not a long list for me; but I did do a delete, modify that command as above and it works as well.

  17. My QuarantineEventsV* file was empty on my 10.6.8 systems. The table and entries were in QuarantineEvents. SO I just adjusted the command line accordingly and now that stuff is gone.

  18. Michael says:

    Matt if you did a copy & paste, you got smart quotes around the delete command. Just replace these a standard quote:

    sqlite3 ~/Library/Preferences/* ‘delete from LSQuarantineEvent’

    or manually type the complete command.

  19. Kevin says:

    Wow, good thing my wife doesn’t know a thing about the terminal!


  20. inket says:

    My file quarantine is off, yet I have this history with all the downloads since I installed Lion.

  21. Jim says:

    Mine just says:
    Error: no such table: LSQuarantineEvent

    Not sure if it matters, but I am logged in as a regular user. I tried “su adminusername” but it still didn’t work. I have the File Quarantine warning showing. ??
    I’m running Snow Leopard, if that makes any difference.

  22. Wiggums says:

    Hi folks, to truncate the db do this:

    sqlite3 ~/Library/Preferences/* ‘delete from LSQuarantineEvent’

    In fact, for privacy put it in your ~/.profile.

  23. hi says:

    Yep, worked on mine.
    How can we erase this history ?

    • yes says:

      Yes, you can use this in all modern versions of OS X to both read download history and to erase the download history on any Mac.

      Tested in OS X 10.12 and works exactly as described.

Leave a Reply


Shop on and help support OSXDaily!

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates

Tips & Tricks


iPhone / iPad



Shop on Amazon to help support this site