Download Detective
Provenance answers “where did this come from?”
Apple defines kMDItemWhereFroms as a metadata value describing where a file was obtained. For a browser download, it may contain the direct file URL and the page that linked to it.
Finder can show this as Where from. Spotlight can index it, which makes source-based search possible. Download Detective reads this kind of metadata and groups files by domain so you can trace downloads without opening each item.
Quarantine supports a security decision
The com.apple.quarantine extended attribute is part of the path macOS uses to recognise items obtained from outside the Mac and apply relevant checks. It is associated with warnings and security systems such as Gatekeeper.
Quarantine metadata is not a readable history of every page you visited. Its role is different from WhereFroms, and the information visible in it can vary by the app and workflow.
One can exist without the other
Do not assume the two fields are a pair that must always match. The app that downloads a file controls what it attaches. Later copies and extraction can affect attributes in different ways. Spotlight indexing also affects what metadata queries return.
This means a file may show a source URL but behave differently from another downloaded item, or carry quarantine context while no useful Where from URL appears.
How to inspect without changing anything
Use mdls for the source:
mdls -name kMDItemWhereFroms "/path/to/file"Use xattr to list the names of extended attributes:
xattr "/path/to/file"These commands read information. Avoid commands with flags that delete or rewrite attributes unless you understand the security effect and have a specific reason to do so. Removing quarantine just to silence a warning can bypass a useful protection.
What Download Detective does and does not do
Download Detective is a provenance search tool, not malware scanning software. It helps answer questions such as “which PDFs came from this portal?” or “where did I get this ZIP?” It does not declare a source trustworthy, remove quarantine, bypass Gatekeeper, or scan file contents for threats.
The app uses read-only folder access and performs the metadata scan locally. Opening a saved source URL is an explicit action handed to your default browser.
Use provenance as one part of a safety check
Before opening an old installer or script, consider several facts:
- Do you recognise the exact domain, not just a similar-looking name?
- Is the publisher identified and the software signed?
- Is this still the current official release?
- Does the expected checksum match, when one is published?
- Does macOS show a warning or block the item?
- Can you obtain a fresh copy from the official source?
A saved URL can help with the first question. It cannot answer all the others.
Metadata is evidence, not certainty
Extended attributes can be copied, removed, or changed. Domains can be transferred. Pages can redirect. A file’s content can also change independently of a remembered URL. Treat provenance as a clue about the file’s path, not a cryptographic guarantee.
For routine file finding, that clue is often exactly what you need. For a security investigation, preserve the original file and metadata, avoid opening it, and follow your organisation’s incident process or ask a qualified professional.