Download Detective
Search the GitHub domain first
Open Terminal and run:
mdfind -onlyin ~/Downloads 'kMDItemWhereFroms == "*github.com*"c'This asks Spotlight for files in Downloads whose saved source contains GitHub’s domain. It can find more than ZIP files, including DMGs, PDFs, images, source archives, and release binaries.
If you moved downloads into a development folder, run the same query there. Drag the folder into Terminal after -onlyin if its path is long.
Inspect the full repository or release path
Once you have a likely file, print its saved source:
mdls -name kMDItemWhereFroms "/path/to/archive.zip"The result may contain a GitHub page and a direct asset address. A repository owner, repository name, release tag, or releases/download path can identify the project even when the local filename is unclear.
Some generated source archives use related GitHub domains or delivery hosts. Begin with github.com, then inspect any nearby files from the same date if the exact item does not appear.
Browse GitHub files in Download Detective
Download Detective lists source domains and file counts for the folder you choose. Select github.com, filter for archives or applications, and search for part of an owner name, repository, release tag, filename, or full URL.
This is particularly helpful when you cannot remember what to put in a command. The source inspector shows all saved URLs for the selected file. You can reveal the archive in Finder, preview supported files, copy its path, or open the source page in your browser.
The scan is local and read-only. Download Detective does not connect to GitHub to build the list. It only opens a URL if you choose that action.
Do not assume an old binary is still current
Finding the source explains where a file came from. It does not tell you that the download is the latest version or safe to run today. Check the project’s current release page, signing information, checksums, and security notices before using an old installer or executable.
Be cautious when a repository has been renamed, transferred, archived, or deleted. A historical URL may redirect somewhere new. Read the current domain and destination before downloading anything else.
Why a GitHub file may show no source
A command-line download made with a tool that did not attach source metadata may appear as Unknown Source. Unpacking an archive creates new files that usually do not each inherit the archive’s original web URL. Moving through a non-Mac filesystem or certain sync paths can also remove extended attributes.
Search for the original ZIP or disk image, not only the extracted folder. The container file is more likely to carry the browser’s download source.
Make future downloads easier to recognise
Keep release archives until the project is safely set up, and rename only when a clearer name helps. Store important dependencies through a package manager or a checked-in dependency file rather than relying on a forgotten ZIP. For manual assets, record the project URL in a README or project note.
Download source metadata is excellent for tracing an old file. Reproducible project setup is still the better long-term habit.