xattr: com.apple.metadata:kMDItemWhereFroms, origin of downloaded file

Type: com.apple.metadata
Subtypes: kMDItemWhereFroms
Serialisation: none
Data type: binary property list containing largely UTF-8 text. An NSArray containing one or more NSStrings
Example: <62706c69 73743030 a201025f 10426874 7470733a 2f2f7071 72732e6f 72672f6f 73782f6b 61726162 696e6572 2f66696c 65732f4b 61726162 696e6572 2d456c65 6d656e74 732d3131 2e332e30 2e646d67 5f101f68 74747073 3a2f2f70 7172732e 6f72672f 6f73782f 6b617261 62696e65 722f080b 50000000 00000001 01000000 00000000 03000000 00000000 00000000 00000000 72> «bplist00¢ _ B[]pqrs.org/osx/karabiner/files/Karabiner-Elements-11.3.0.dmg_ []pqrs.org/osx/karabiner/ Pr»
Note – in the above, the square brackets [] represent the characters https followed by a colon and two slashes, to overcome limitations with WordPress thinking that there is an embedded link
macOS: Sierra, High Sierra
System use: only found in /Library, and infrequent there
App use: some
Document use: more common
Other usage: none

Purpose: contains the originating URL of many downloaded files
Displayed as the Where from item in More info of the Finder’s Get Info dialog.

As with all xattrs, this ‘sticky’ information can follow downloaded files around for a long time.

Tools: Finder (Get Info dialog), xattred, xattr


Original page: 2017-12-18
Last modified: 2017-12-30