Show Download History List of All Files Ever Downloaded Within Mac OS X
Have you ever wanted to show a list of the entire download history of a Mac? Maybe you know you downloaded a file but you can’t quite pinpoint where you got it from and the “Get Info” trick didn’t work. Or maybe you are trying to track down a file that has been placed on a system that led to problems. Whether it’s for troubleshooting, personal interest, or forensics, the following command will show you everything that you’ve downloaded to a Mac regardless of the application that it came from:
How to View a List of All Files Downloaded to a Mac
This works by querying the file quarantine database of OS X, which is aimed at protecting Macs from malicious downloads. You’ll use the Terminal application and sqlite for this purpose.
- Launch Terminal from /Applications/Utilities/ and enter the following command into a single line:
- Hit return to see the list of downloaded files
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'
Depending on how old the Mac is and how much stuff you’ve downloaded, it can take a while to query the database and dump the results. You may want to pipe the results through “sort” to group the downloaded list into similar items or sources, that would look like this:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent' | sort
For ease of viewing, you can also redirect the output into a text file, this command will dump the list into a file called “QuarantineEventList.txt” on the active users desktop:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent' > ~/Desktop/QuarantineEventList.txt
The output lists everything that has been passed through the Quarantine Manager, which for the last several versions of Mac OS X is quite literally every item downloaded to the Mac, regardless of the application it came from. Generally, the older the Mac is and the more files have been downloaded, the larger the list, and the longer the query can take to run.
This list even works if you have file quarantine turned off for files and apps, thanks to inket for verifying that.
Deleting the Download History List
For those who would rather not have an all-inclusive historical list of downloaded files, you can run the following command to delete the contents of the quarantine database:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'delete from LSQuarantineEvent'
You can run that individually, or place it into .bash_profile or .profile to clear the database automatically when a new terminal window is launched.
This has been tested and continues to work in many versions of Mac OS X, from earlier versions through to OS X El Capitan (10.11.x+), OS X Yosemite, OS X Mavericks 10.9.5 and presumably newer. Let us know in the comments if you have success with this command and the version of OS X that you have used it with.
Thanks to Scott for the great tip, and thanks to Wiggums for the delete syntax.
I’m amazed by how far back this goes but I don’t think it has everything because I’m trying to find the name of a game I downloaded a year ago, but it doesn’t show any downloads from game sites.
I am running Big Sur and Monterey on my new iMac and this code in Terminal is working fine. Thank you
Hey, commands don’t work in Yosemite. Is there an updated version?
The commands definitely work in OS X Yosemite, just did it myself in 10.10.4. Be sure you are entering the text properly.
Aha. Had to change the curly quote to straight. That worked.
Curious, you said 10.10.4 – developer release?
Error: no such table: LSQuarantineEvent
I’ve tried all different ways and nothing of this hint works in 10.8.2 on an iMac 27″.
The article is incorrect in its description of the scope of what the “Quarantine Manager” sees and records in the QuarantineEvents database(s). Most of Apple’s own apps (but notably NOT the FTP-as-disk functionality of Finder) use it and so does Google Chrome, but based on a dump of the 15k records (mostly from Mail.app) on my Mac it is clear that Firefox, Thunderbird, MailMate, and NetNewsWire do not and Transmission (a BitTorrent client) seems to only use it for its self-update function. Command-line tools (e.g. curl, wget, etc.) also do not show up.
This is most AWESOME. I research so much stuff, I forget what I’ve downloaded. This is a great way for me to go back to files I needed and re-use them. Sweet.
This data is used by the ‘info’ command on files that were downloaded, so if you delete everything the ‘info’ command won’t tell you where you got the file from originally.
For me, that”s important. I grab example code snippets, standards docs, references, xls’s of proforma biz, all manner of great downloads. Now I can find the files i downloaded and grab the latest versions.
I promise I’ll be better organized next deadline driving, time constrained project! :)
hi all,
i’m a completely noob with terminal, but would love to explore this a bit more, any idea on how to get date and file size?
thanx in advance!
.r
You can turn this off with this defaults command
defaults write com.apple.LaunchServices LSQuarantine -bool NO
I get nothing when I enter the commands above, but using the sudo addon I get
WARNING: Improper use of the sudo command could lead to data loss
or the deletion of important system files. Please double-check your
typing when using sudo. Type “man sudo” for more information.
To proceed, enter your password, or type Ctrl-C to abort.
I can find the QuarantineEvents and QuarantineEventsV2 files, but they all have the same two dates, March 2008 and May 2012. When I open them with textEdit it appears to contain only emails. Searching them reveals no mp3 or txt or other media files, no dmg etc.
It’s a SQL database, not a txt file. Using the sudo command for the first time always issues a warning about its use.
mmm. I get permission denied. I’m logged in as admin
David
add ‘sudo ‘ before the command (without the quotes)
I dont like the idea of MAC saving a list of all my downloads,
I would like to either disable this option or as the article says to delete the list on start up using the .profile or .bash_profile – however after spending a few minutes searching via the terminal im unable to find either of those files mentioned. can anyone shed any advice for a novice MAC user?.
Thank you.
Loz!
just delete the whole thing … launchservice makes a new one as soon as you download something else.
If you’ve disabled Quarantine as I have (defaults write com.apple.LaunchServices LSQuarantine -bool NO)
You can lock the file (via the Get Info window) to prevent further writing to it if you don’t like the idea of your OS logging your dowloads.
You can use Base or another SQL editor if you simply want to edit the file…
Cheers!
can one delete this file altogether?
none of these work;
Error: no such table: LSQuarantineEvent
Error: too many options: “LSQuarantineDataURLString”
Error: too many options: “select LSQuarantineDataURLString from LSQuarantineEvent”
I tried every possible syntax, without the V, *, single quotes, double quotes…etc.
Doesn’t work. 10.6.8
the file “com.apple.LaunchServices.QuarantineEvents” is there though…
Now tell me how to clear this list with pr0n that I download recently :D
None of these commands work. iMac 10.6.8
the following works in 10.6.8
Just needed a bit of fiddling or you get the error about no such table or one about a syntax error at “/”.
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents ‘select LSQuarantineDataURLString from LSQuarantineEvent’
The important bits are to get rid of the V*. I tried * w/out the V but that didn’t work either. Without that it works fine. Not a long list for me; but I did do a delete, modify that command as above and it works as well.
Thanks. Works for me :)
My QuarantineEventsV* file was empty on my 10.6.8 systems. The table and entries were in QuarantineEvents. SO I just adjusted the command line accordingly and now that stuff is gone.
FWIW, I reinstalled Lion today and I’ve got QuarantineEvents and QuarantineEventsV2.
Matt if you did a copy & paste, you got smart quotes around the delete command. Just replace these a standard quote:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘delete from LSQuarantineEvent’
or manually type the complete command.
Wow, good thing my wife doesn’t know a thing about the terminal!
;)
My file quarantine is off, yet I have this history with all the downloads since I installed Lion.
Mine just says:
Error: no such table: LSQuarantineEvent
Not sure if it matters, but I am logged in as a regular user. I tried “su adminusername” but it still didn’t work. I have the File Quarantine warning showing. ??
I’m running Snow Leopard, if that makes any difference.
Hi folks, to truncate the db do this:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘delete from LSQuarantineEvent’
In fact, for privacy put it in your ~/.profile.
This is a great additional tip, thanks Wiggums
sqlite3: Error: too many options: “from”
is there anything I am missing?
replace your single quotes around delete from LSQuarantineEvent with straight quotes
got it.
thanks.
Yep, worked on mine.
How can we erase this history ?
Yes, you can use this in all modern versions of OS X to both read download history and to erase the download history on any Mac.
Tested in OS X 10.12 and works exactly as described.
-bash: /Users/michael/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2: Permission denied