01Location
- ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
- ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents (older systems)
02Questions it answers
- Which application downloaded or received a file, and when?
- From which URL, and from which referring page, did a download come?
- Which sender name or address was associated with a received file?
03Format and versions
| Format | SQLite 3 database (no file extension) with table LSQuarantineEvent; LSQuarantineTimeStamp is a REAL Mac absolute time. |
|---|---|
| Applies to | File Quarantine was introduced in Mac OS X 10.5 Leopard. Column names here follow the plaso parser schema. |
04Key fields
| Field | What it tells you |
|---|---|
| LSQuarantineEventIdentifier | Primary key (text) of the event. |
| LSQuarantineAgentName, LSQuarantineAgentBundleIdentifier | Name and bundle identifier of the application that quarantined the file. |
| LSQuarantineDataURLString | URL of the data itself (for browsers, the download URL). |
| LSQuarantineOriginURLString, LSQuarantineOriginTitle | Origin page URL and title (for browsers, typically the referrer). |
| LSQuarantineSenderName, LSQuarantineSenderAddress | Sender details when supplied by the agent. |
| LSQuarantineTypeNumber | Numeric quarantine type, for example a web download or other download. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| LSQuarantineTimeStamp | Mac absolute time: REAL seconds since 2001-01-01 00:00:00 UTC | When the OS assigns quarantine automatically, the timestamp is the current time at file creation. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy the database for every user account.
- Convert LSQuarantineTimeStamp by adding 978307200 to obtain Unix seconds.
- Match data URLs and times with browser download records (Chromium downloads, Firefox download annotations).
- Check the com.apple.quarantine extended attribute of candidate files on disk for consistency.
07Interpretation pitfalls
- Applications set the URL properties themselves; automatic quarantine (LSFileQuarantineEnabled) supplies only time, agent name and bundle ID.
- Chromium source notes that, as of macOS 12.4, the extra download metadata it supplies is not stored by macOS, so empty URL columns do not prove an unknown source.
- Launch Services can clear the quarantine properties of a file once the user opens it, so the file attribute and the database can disagree.
09Sources
- plaso — parsers/sqlite_plugins/ls_quarantine.py log2timeline/plaso (GitHub) · checked 2026-10-14
- Launch Services Framework Release Notes for OS X v10.5 (File Quarantine) Apple Developer Documentation Archive · checked 2026-10-14
- Chromium source — components/services/quarantine/quarantine_mac.mm The Chromium Authors (GitHub mirror) · checked 2026-10-14
- ForensicArtifacts — artifacts/data/macos.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14