Why Does Apple Keep History Of Every File Downloaded In OS X?

View Apple OS History

Have you ever wanted to look at what you have downloaded years ago on an OS X computer? No? Well Apple is keeping this information for you anyways. The blog  idownloadblog has uncovered the way to unveil all the download details.

“It’s essentially an SQL command that you run via Terminal. It goes into the database and extracts the full contents of your download history logs as found in the LSQuarantineEvent. It doesn’t matter where, or how you downloaded these files, in most cases the download should be logged.”

The only downloads that are not found here are  Mac App Store apps. Pretty much everything else can be found with the commands below.  Using secure browsing methods do not stop the OS from capturing the files. Private browsing in Safari  and incognito mode in Google Chrome do not stop the log from tracking downloads.

“Step 1: Open Terminal

Step 2: Copy and paste the following command into your Terminal window:

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘select LSQuarantineDataURLString from LSQuarantineEvent’

Step 3: Press Return on your keyboard and a full list of all of the files logged within LSQuarantineEvent will be printed to the Terminal screen. You can then copy and paste the entire Terminal window, or individual file locations.”

Users that would like to download the history and save it to a file can run the following command in terminal. This will output the all history to a .txt file in the downloads folder.

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘select LSQuarantineDataURLString from LSQuarantineEvent’ > ~/Downloads/downloadhistory.txt\

Mac OS X users can also clear out the history by running this command in terminal. It is important to note that this will not stop the process, but it will clear the results saved in the OS. Both of these SQL commands were posted by Reddit user Swested.

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘delete from LSQuarantineEvent’

A major question on the minds of OS X users is why this information is kept? Can it be accessed by Apple or other programs? This file can be cleared, but stopping the recording process has unknown effects on the overall security.

This same security is becoming a factor for Apple users who have previously been “safe” from malware. The most recent Java exploits also effect many older versions of Java for the Mac. This type of problem with Java has caused Apple to previously remove the Java plugin from all OS X browsers. OS X might be based on the more secure Unix OS, but 3rd party software and plugins are often found to be vulnerable.

Check download history on OS X with Terminal

Check download history on OS X with Terminal
Description: How to extract download history from the OS X Terminal.

Be the first to comment on "Why Does Apple Keep History Of Every File Downloaded In OS X?"

Leave a comment

Your email address will not be published.