It’s one of those features we take for granted, that the Finder and many of our apps remember the most recent documents we opened. This is the product of many property lists saved in ~/Library/Application Support/com.apple.sharedfilelist, where you’ll see those for the Finder, and those for individual apps in the folder com.apple.LSSharedFileList.ApplicationRecentDocuments within it. These are claimed to be sfl2 files (until Mojave they were sfl), but turn out to be yet more property lists, and sfl stands for Shared File List.

Although they’re just property lists, trying to make sense of them isn’t simple, as they don’t contain any file names or paths, just inscrutable UUIDs and chunks of gibberish text that appear to be binary encoded in Base-64. Here I’ll show you how to decode those Bookmarks and resolve them to discover what those Shared File Lists contain.

Two techniques are commonly used to specify files in property lists like these: simple URLs saved as strings, and Bookmarks encoded in Base-64. URLs work nicely until that file is moved; once broken, the URL is useless as a means of locating the file. If you’d like to experiment with those documents listed in an app’s Open Recent… menu command, you’ll see that the items listed there still work if the original file is moved around on the same volume. That’s because the property list uses Bookmarks instead of URLs.

Bookmarks are a variant of Finder Aliases, which were introduced in System 7, over 30 years ago in 1991. From the outset, Aliases have been presented as opaque data structures that are handled by the system. Although apps have been able to obtain information from them, Apple hasn’t intended any more general access to the data they contain. Bookmarks are a generalisation of Aliases introduced in OS X 10.6, and have been used extensively inside macOS and applications since at least Mavericks 10.9 in 2013.

Prior to macOS Sierra, Finder Aliases (and some Bookmarks) were usually quite large, containing icons and other data, and were typically over 1 MB on disk. Early releases of Sierra, even 10.12.1, didn’t always work properly with the new compact Bookmark and Alias formats introduced then, but they have since become widespread and generally fully compatible with the system and apps. If you remember struggling with Aliases, it’s probably from that time of transition.

The current Alias format is typically around 1 KB, making them almost as efficient in terms of storage as symbolic links, although macOS continues to use symlinks rather than Aliases in many places, particularly where paths have to be resolved by commands and scripts. macOS still has no native support for the resolution of Aliases or Bookmarks at the command line, although my command tool alisma puts that right.

Open one of those Shared File Lists in a suitable text editor like BBEdit, and find an encoded Bookmark within it. Open Precize, and from its Window menu use the Open Resolver command to display a new resolver window.

Copy the whole of the encoded Bookmark, from immediately after <data> to just before </data>, and paste that text into the upper text box in the resolver. When you click on the Analyse button, Precize will display the Bookmark in the lower text view in three different formats: first, as the content fields in the Bookmark, then as hex raw data, and finally by its table of contents.

Click on the Resolve button and Precize shows the path to the file both as a normal URL and using the volfs file system. If the Bookmark has been successfully resolved, the Preview button shows that file in a QuickLook preview, and you can see the file in a Finder window using the Reveal in Finder button.

Among the more useful data resulting from a file being analysed are:

• _NSURLPathKey gives the full path to the file,
• _NSURLBookmarkURLStringKey gives the file’s full URL,
• NSURLCreationDateKey gives the file’s creation timestamp,
• NSURLIsRegularFileKey indicates whether it’s a normal file,
• NSURLIsPackageKey indicates whether it’s a package rather than a file,
• _NSURLBookmarkSecurityScopeCryptoKeyKey is used if this is a Security-Scoped Bookmark, most used with sandboxed apps.

Precize does a great deal more than that. Its main window displays lots of information about files, and will generate a Bookmark for any file you open in the app.

So now you know the Finder and apps maintain their Recent items lists in Shared File Lists using Bookmarks, and how to decode and resolve them, to discover their contents.