News for hackers. Stuff that matters.

A comment on iCloud was storing cleared browsing histories. Parent comment

Re:iCloud was storing cleared browsing histories by skissane on Friday February 10, 2017 @03:46AM (#13614100)
Today I learned that $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 is a sqlite database. The LSQuarantineEvent table contains every file you ever downloaded, the source URL is in the LSQuarantineDataURLString column.

sqlite3 $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'select LSQuarantineDataURLString from LSQuarantineEvent'

sqlite3 $HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'delete from LSQuarantineEvent'

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by justinclift on Friday February 10, 2017 @07:13AM (#13614830)
It's directly loadable using a GUI too (eg sqlitebrowser.org), for anyone that prefers the graphical approach.

And yeah, it had all kinds of interesting stuff I've downloaded over the years in mine. Now cleared. ;)

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by Udo_Schmitz on Friday February 10, 2017 @06:14AM (#13614586)
Interesting. But I see only fairly old stuff there. And I'd guess only downloads from a single day or week a few years ago.
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by petrikapu on Friday February 10, 2017 @05:36AM (#13614477)
Select gives me 22 rows. I'm pretty sure I've download much more. Maybe per session?
[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by skissane on Friday February 10, 2017 @06:17AM (#13614605)
I saw stuff in there I downloaded days or maybe even weeks ago. (Couldn't tell you exactly when since I've deleted it all now.) I've heard reports of people seeing downloads from years ago.

Here is a SQL to view timestamps:

SELECT datetime(LSQuarantineTimeStamp + 978307200, "unixepoch", "localtime") as LSQuarantineTimeStamp from LSQuarantineEvent

(Based on http://www.forensicswiki.org/wiki/Mac_OS_X with modification.)

In my testing, only downloads from Safari are logged here, not those from Firefox (haven't tested Chrome). If you don't use Safari as your primary browser, that might explain not seeing many downloads.

[ Parent | on HN ]
Re:iCloud was storing cleared browsing histories by feelix on Friday February 10, 2017 @06:07AM (#13614569)
No, it's permanent. Try the app and I think you'll see a longer history.
[ Parent | on HN ]