Where Are macOS Quarantine Events Stored?
macOS QuarantineEvents database with download origins and Gatekeeper history.
Last updated
macOS logs every quarantined download's origin URL, referrer and timestamp in a QuarantineEvents SQLite database per user. Gatekeeper verdicts trace back to these rows during incident response.
The com.apple.quarantine extended attribute on files points here. Clearing history removes download provenance investigators rely on.
Where macOS stores this, by platform
~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite database with download agent, URL, timestamp and quarantine state per file. Query it read-only with sqlite3 during investigations. Modern systems may version the filename, so list the Preferences folder for variants.
Frequently asked questions
How do I see where a Mac file downloaded from?
Check its com.apple.quarantine attribute, then match the timestamp in the database above for the full origin URL.
Can I clear quarantine history?
Yes by deleting the database file, but download provenance vanishes with it. Keep copies on investigated machines.
Notice an outdated path? Let us know.