Download Detective
First, confirm that the field is really absent
Select the file in Finder, press Command-I, and expand More Info. If no Where from field appears, check the indexed value in Terminal:
mdls -name kMDItemWhereFroms "/path/to/file"A list of strings means the data exists. (null) means Spotlight is not returning the attribute for that item. If the file is on an unindexed disk or excluded location, metadata search may be incomplete.
The downloading app may not have saved it
The source field is supplied by the app that obtains or creates the file. Browser behavior, download method, and app version can affect what gets written. A file fetched by a script or command-line tool may not carry the same metadata as one saved through a browser.
Locally generated files have no web origin to record. Exports from editors, scanners, and office apps are new files, even when their content originally came from somewhere else.
A transfer may have stripped Mac metadata
Extended attributes can be lost when a file moves through systems that do not preserve them. Common paths include some ZIP workflows, non-Mac filesystems, network shares, web uploads and downloads, and cloud services.
Check an earlier copy, the original downloaded archive, Time Machine, or another Mac where the file existed before the transfer. If the source survives anywhere, it is often on that earlier item.
Extracted files are not the original download
When you download a ZIP file, the ZIP is the item the browser saved. Files created by extracting it may not each receive the same Where from value. If a folder full of source code appears unknown, inspect the archive beside it.
The same idea applies to disk images and installers. The DMG or package may have provenance even when files copied out of it do not expose the same source.
What Download Detective shows
Download Detective places files without usable source metadata under Unknown Source. This makes the limitation visible instead of guessing. The app cannot reconstruct missing values, inspect browser history, or contact websites to infer an origin.
You can still search those files by name, extension, path, or type and sort by date or size. This often helps locate the item even when its source is unknown.
Other places to look
- Browser history: search the date range and likely domain.
- Browser downloads list: it may retain the filename and source longer than expected.
- Email or messages: search for the filename, subject, or sender.
- Account download pages: banks, stores, portals, and cloud services may list past files.
- Backups and earlier copies: the metadata may survive there.
- Project records: README files, issue links, and notes may explain the file.
What not to conclude
Missing source metadata does not mean the file is malicious. It also does not mean the file is safe. The field is optional context, not a security verdict.
Do not invent a source based on a logo, filename, or document text. If origin matters for legal, financial, or security reasons, obtain a fresh copy from a known official source and verify it through the process appropriate to that file.
Prevent the problem for important downloads
Save important records into named folders, give them clear filenames, and keep the email or page that supplied them. For software, use official package managers, signed releases, and checksums where available. Source metadata is a convenient clue, but deliberate records are more dependable.