Quick Look Cache

Overview

Quick Look is macOS's built-in file preview system. When a user previews a file (via spacebar in Finder, or the preview pane), macOS generates a thumbnail image and caches it. These cached thumbnails persist independently of the original file, meaning Quick Look can provide visual evidence of file contents even after the file has been deleted from the system.

Forensic Significance

File Locations

Database Schema

index.sqlite

Key Fields for Analysis

-- List all cached thumbnails with access counts
SELECT
    rowid,
    file_id,
    width || 'x' || height AS dimensions,
    hit_count,
    datetime(last_hit_date + 978307200, 'unixepoch') AS last_accessed,
    size AS data_size
FROM thumbnails
ORDER BY last_hit_date DESC;

Extract Thumbnails

The thumbnail image data is stored in the thumbnails.data blob file. Each thumbnail can be extracted using the offset and length from the index:

import sqlite3

conn = sqlite3.connect('index.sqlite')
cursor = conn.execute(
    "SELECT rowid, bitmapdata_location, bitmapdata_length FROM thumbnails"
)

with open('thumbnails.data', 'rb') as f:
    for row_id, offset, length in cursor:
        f.seek(offset)
        data = f.read(length)
        with open(f'thumb_{row_id}.png', 'wb') as out:
            out.write(data)

Timestamps

Quick Look timestamps use Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC).

Analysis Notes

• Deleted file recovery: The primary forensic value of Quick Look cache is that thumbnails persist after the original file is deleted. A thumbnail of a sensitive document proves the document existed and was previewed.
• Hit count analysis: The hit_count field shows how many times a file was previewed. High hit counts indicate files the user repeatedly accessed.
• External media: Quick Look generates thumbnails for files on external drives. These thumbnails persist in the cache even after the drive is disconnected, providing evidence of the drive's contents.
• File node correlation: The file_id field is a filesystem inode number. On HFS+/APFS volumes, this can be correlated with FSEvents or filesystem metadata to identify the original file.
• Cache size limitations: Quick Look periodically prunes the cache when it exceeds a size threshold. Older thumbnails may be purged.
• SIP protection: The cache location is in the user's Library directory and is not SIP-protected.

Version Differences

Tool Support

References

• Quick Look Forensics - SANS
• Quick Look Cache Analysis
• SANS FOR518: Mac and iOS Forensic Analysis