How to extract OS X download history via Terminal

By , Jan 14, 2013

Download Terminal OS X

Have you ever wanted to go back and check your Mac’s entire download history in one fell swoop? With this handy Terminal command your download history is only a few steps away.

One of our readers tipped this to me via Twitter. It’s essentially an SQL command that you run via Terminal. It goes into the database and extracts the full contents of your download history logs as found in the LSQuarantineEvent. It doesn’t matter where, or how you downloaded these files, in most cases the download should be logged.

One exception that I’ve noted is with Mac App Store apps. Items downloaded from the Mac App Store are not logged here. Take a look at our video inside for a glance into how it works…

Step 1: Open Terminal

Step 2: Copy and paste the following command into your Terminal window:

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'

Step 3: Press Return on your keyboard and a full list of all of the files logged within LSQuarantineEvent will be printed to the Terminal screen. You can then copy and paste the entire Terminal window, or individual file locations.

In my particular case, my download history was pretty shallow because I just reinstalled OS X. How far back does your download history go?

  • Share:
  • Follow:
  • Guest

    ummm.. ok..

    • Jeff

      I’m going to go out on a limb and guess that you don’t have a Mac.

      • tggt00

        Yeah you right.. me too.. I dont have a mac :(

      • http://www.facebook.com/ryanjames.christensen Ryan James Christensen

        It’s only for Mac be cause it searches Mac libraries. I think Mac and PC file locations are different.

      • http://hbang.ws/ Adam D

        The file system layout is quite different between Windows and OS X, yes. I don’t think such a thing even exists on Windows; browsers should have a similar database though.

      • http://www.facebook.com/ryanjames.christensen Ryan James Christensen

        I do believe there is a Windows Version of Terminal but I don’t it does the same thing as the Mac Terminal.

      • http://hbang.ws/ Adam D

        Command prompt. It’s the same sorta thing but the scripting language and tools provided are quite different.

      • Ahmadjoon

        And me too!mac is on realy expensive devices so i cant buy!

      • tggt00

        Yeah you so right!!!!!! And here in Israel its so expensive!!!

      • jose castro

        why only mac?

  • workin

    first got SQL error: near “‘select”: syntax error

    then copy from OP at karthikk.net I get

    SQL error: no such table: LSQuarantineEvent

  • Austin Colby

    Try this…

    sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 ‘select distinct LSQuarantineDataURLString from LSQuarantineEvent’

  • No need

    So the question is how do I stop my Mac from logging my every download? I personally like my privacy.

    • http://twitter.com/joek1971 Joseph

      try this:

      sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 ‘select distinct LSQuarantineDataURLString from LSQuarantineEvent’

      • No need

        Your suggestion just did the same as the OP, displayed download history. I found the answer on another site though:

        sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘delete from LSQuarantineEvent’

    • Larry Seltzer

      OMG! If an attacker gets arbitrary code execution privileges on my machine he might be able to violate my privacy! Seeing this list will be the least of your problems.

      • http://flavors.me/ryanlaing september11th

        Or someone snooping on your computer.

      • Larry Seltzer

        Old truism: There is no security without physical security

  • Guest

    i got this message:

    Error: too many options: “LSQuarantineDataURLString”

    • http://thomas-degry.be/ Thomas Degry

      Same here

    • Sebastian

      same here

      • Jeff

        The problem was my fault. The quote format I had it in broke up the command. I removed the quote. You should be able to copy and paste the command now. Sorry for the inconvenience.

  • http://twitter.com/joek1971 Joseph

    ok now it works, is there a way to clear it entire history

    • Jamie Dalgetty

      I’d like to know this as well.

  • O. Bakerman

    Not working.

    sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* [ENTER]
    select LSQuarantineDataURLString from LSQuarantineEvent; [ENTER]

    Did though.

    • CyberSkull

      That should be one line. If you want to break it up place a at the end of the line before you press enter.

  • http://twitter.com/joerodr Joe Rodriguez

    Why not pipe it out to a text file like so

    sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘select LSQuarantineDataURLString from LSQuarantineEvent’ > ~/Downloads/downloadhistory.txt

  • Doug

    ERROR: TOO MANY OPTIONS. LOL

  • Seth

    A purely executed blog. Spell check!! Edit!! and then go.

  • Edward Garcia

    How can I save the list as a text document? Thanks.

  • Michael Vilain

    sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents* ‘select LSQuarantineDataURLString from LSQuarantineEvent’

    worked better on my 10.6.8 system. There’s no QuarantineEventsV* on my system and the posted command just created a file with zero content. I regularly clear my history so mine was empty.

  • Privacy

    As this is just a simple sqlite3 database, you can delete entries, too:

    sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘delete from LSQuarantineEvent where LSQuarantineOriginURLString like “%something%”‘

    replacing something with the text you want to remove.

    To verify this has worked, run this:

    sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* ‘select * from LSQuarantineEvent where LSQuarantineOriginURLString like “%something%”‘

    (remembering the change the text to the as before)

    • http://www.facebook.com/littlemeow2012 Little Meow

      What about deleting everything?

  • tj

    running snowleopard….table does not exist.

  • Bob A

    On my MBP (Lion), the command listed downloads **and** Terminal activity. For instance, a Terminal process that I used to assign random names to a folder full of pictures so that they would show up “randomly” on my digital frame showed up with all the original and new filenames.

  • Kurt Tappe

    Doesn’t work in Snow Leopard (10.6). Gives an “SQL error: no such table: LSQuarantineEvent” error.