Download Detective
What the long name means
The kMD part refers to metadata used by Spotlight. An MDItem represents a file and its indexed metadata. WhereFroms is the field for one or more descriptions of where that item was obtained.
Apple defines the value as an array of strings. That is why a file can have more than one source. A download may record the address of the file itself and the page that linked to it. An item received through another kind of app may contain a different description, such as information related to a message.
It is metadata, not part of the document
The source URL is not normally written into the visible content of a PDF, image, ZIP file, or video. It is filesystem metadata attached to the item. Editing the document does not necessarily change it. Renaming or moving the file on the same Mac may leave it in place.
That distinction matters when files are transferred. A ZIP tool, non-Mac disk, cloud service, or server may copy the main file data but drop Mac-specific metadata. The document still opens, but its source trail is gone.
How to read kMDItemWhereFroms
For one file, Finder is usually enough. Select the file, press Command-I, and look for Where from. To see the Spotlight value directly, use:
mdls -name kMDItemWhereFroms "/path/to/file"A typical result resembles a list:
kMDItemWhereFroms = (
"https://example.com/files/manual.pdf",
"https://example.com/support/downloads"
)The order and contents depend on the app that saved the file. Do not assume every first URL is a human-readable page or that every second URL is a referrer. Treat them as saved source strings and inspect them before opening.
How it relates to the extended attribute
You may also see the name com.apple.metadata:kMDItemWhereFroms when using the xattr command. That is the extended attribute behind the familiar source information in many cases. Its raw value is encoded data, so mdls is easier when you only want to read the indexed URLs.
Do not confuse this attribute with com.apple.quarantine. Quarantine supports macOS security checks for downloaded items. WhereFroms describes a source. The two can appear together, but they have different jobs.
Search the attribute across many files
Spotlight can query the field. This command searches Downloads for files whose saved source contains example.com:
mdfind -onlyin ~/Downloads 'kMDItemWhereFroms == "*example.com*"c'This works well for a quick, exact query. If you do this often, Download Detective provides a visual version: choose a folder, browse source domains and file counts, then filter by filename, extension, path, domain, or URL. It reads the same kind of local provenance and clearly separates files with no known source.
Why the result can be null
A null value has several possible causes:
- The file was created locally rather than downloaded.
- The browser or app did not save source metadata.
- A copy or transfer stripped extended attributes.
- Spotlight has not indexed the file or the location is excluded.
- The metadata was removed later.
It is not safe to infer a file’s origin from its name alone. It is also not safe to infer that a file is trustworthy because WhereFroms is absent. Source metadata is useful context, not proof of identity or safety.
What this metadata is good for
It can help you find a vaguely named download, return to a product page, identify which client portal supplied a document, group downloads by website, or check context before opening an old installer. It is less suitable as a permanent audit log because its presence depends on the download and transfer path.
For lasting records, keep receipts, bookmarks, project notes, or a proper document system. Think of kMDItemWhereFroms as a helpful trail attached to many files, not a complete history of everything downloaded on the Mac.