SPOTFILES MAC HOW TO
SPOTFILES MAC FULL

LSQuarantineOriginURLString– the website containing the link to the downloaded file.If we’re interested in investigating browser downloads, the below fields come in handy as well: LSQuarantineAgentName – which we need to filter out AirDropped files from other quarantined files if a file has been AirDropped, the agent name will be sharingd.LSQuarantineSenderName – the name associated with the Apple ID of the sending device.LSQuarantineTimeStamp – the date the file was received / downloaded.LSQuarantineEventIdentifier – which is equivalent to the value revealed by the xattr command.It only contains one table, LSQuarantineEvents, which consists of the following fields:įrom the perspective of investigating AirDrop transfers, we are interested in the following fields: The database is located in ~/Library/Preferences/2. The unique file identifier happens to also be logged in the quarantine database in the LSQuarantineEventIdenfier field and is the value which will allow us to link the database entry to a specific file. The next value is the agent from which the file originates that’s sharingd for AirDrop and for browsers it usually uses their names like so: Kingas-MacBook-Pro:Downloads kingakieczkowska$ xattr -p Spotify-0.8.5.dmg 0081 5ef7b1c6 Chrome 47E57525-8A80-43BC-8193-DB61878C1C75

SPOTFILES MAC HOW TO

The timestamp in hex is pretty self explanatory, although it might be confusing how to turn it into a human-readable format – for this I recommend using an online tool such as this one, and if you’re interested in a programmatic solution bear with me to see in my script how it can be done in Python.

The flags in the beginning are Gatekeeper scores (via here and here), determining what kind of security checks must be performed when the user tries to open the file. The output we get can be decoded as follows: flags downloaded / received timestamp in hex agent unique file identifier We can do that by adding a -p (print) flag to the xattr command and specifying the attribute to be printed like so: Kingas-MacBook-Pro:files kingakieczkowska$ xattr -p IMG_0631.JPG 0081 5ecaae8a sharingd 29B870EA-BB4A-41EB-B014-F722B33D1C26 We’re interested in what the attribute looks like, so let’s view it for IMG_0631.JPG. We can check them by running the xattr command against any given file (full demo in Mikey’s post). rw-r-r- 1 kingakieczkowska staff 328217 12 May 11:02 BIAŁKA.pptx -rw-r-r- 1 kingakieczkowska staff 1033732 9 May 23:58 Collage_Fotor1.jpg -rw-r-r- 1 kingakieczkowska access_bpf 2298741 24 May 18:27 IMG_0631.JPG -rw-r-r- 1 kingakieczkowska access_bpf 1954141 27 May 16:37 IMG_6944.jpgĮvery file with an the end of the permissions will have extended attributes. It’s easy to spot files which contain extended attributes by running ls -la: Kingas-MacBook-Pro:files kingakieczkowska$ ls -la total 10992 drwxr-xr-x 6 kingakieczkowska staff 192 14 Jun 18:12. I’d actually recommend you read Mikey’s post first before diving into this I’m only glossing over things he explains in detail.Įxtended attributes can be viewed, edited and deleted using the xattr command.

SPOTFILES MAC FULL

I, however, am going to focus solely on the attribute, but for a full overview please head on over to Mikey’s write up and Tuxera’s post as those are brilliant resources on the topic. This is the attribute holding flags which may lead to you seeing a popup like so:Įxtended attributes are not exclusive to macOS, other operating systems have them too, and – as you can imagine – their functionality is not limited to detecting downloaded and AirDropped files. One of the extended attributes is, which is added to files downloaded from the Internet or AirDropped (coming from a foreign source) for enhanced security. What are extended attributes? They are key value pairs holding additional metadata about a file. To make that process easier, I’ve written a Python tool – more on later though, let’s start from the beginning. As it turned out, it is possible to link entries in that database to actual files in the file system by the value of a specific extended attribute of AirDropped and downloaded files. Those are looking into the quarantine database and the extended attribute attached to downloaded files, including those transferred using AirDrop. After I published the AirDrop Forensics post my dear friend Mikey got in touch to let me know about other ways of obtaining AirDrop artefacts.

Spotfiles mac