Spotlight Metadata

Overview

Spotlight is the macOS system-wide search and indexing service. It maintains comprehensive metadata databases that index the contents and attributes of every file on each volume, along with per-user search history and configuration preferences.

From a forensic perspective, Spotlight provides three distinct categories of evidence:

1. Search shortcuts -- A record of what the user searched for and which items they launched from Spotlight, including timestamps.
2. Configuration and preferences -- Which search categories are enabled or disabled, and which paths are excluded from indexing (exclusions can reveal deliberate attempts to hide activity).
3. Volume metadata stores -- Proprietary binary databases containing indexed file metadata (kMDItem attributes), which can reveal information about files even after they have been deleted.

The Spotlight metadata store uses a proprietary binary format (not SQLite). macfor collects the parseable plist-based artifacts (shortcuts, preferences, volume configuration) and optionally collects raw store files for offline analysis with specialised tools.

Forensic Significance

File Locations

Per-User Artifacts

System-Wide Artifacts

APFS Data Volume (macOS 10.15+)

On Catalina and later, the volume stores are located on the Data volume:

Raw Store Files

The volume metadata store directory contains these key files:

These files use a proprietary binary format (not SQLite). They require specialised parsers such as spotlight_parser or mac_apt for analysis.

Database Schema / File Format

Spotlight Shortcuts (com.apple.Spotlight.plist)

The shortcuts are stored in a binary plist under the UserShortcuts key:

UserShortcuts = {
    "<search_query>" = {
        DISPLAY_NAME = "<item name>";
        LAST_USED = <CFAbsoluteTime>;  // Seconds since 2001-01-01 00:00:00 UTC
        URL = "<file or application URL>";
    };
};

The orderedItems key contains the user's search category preferences:

orderedItems = (
    {
        enabled = 1;
        name = "APPLICATIONS";
    },
    {
        enabled = 1;
        name = "DOCUMENTS";
    },
    {
        enabled = 0;
        name = "FOLDERS";
    },
    ...
);

Shortcuts.v3 Format

The .v3 variant (macOS 14 Sonoma and later) uses a similar dictionary structure with search queries as keys mapping to shortcut metadata. The format is functionally equivalent to the original.

VolumeConfiguration.plist

Stores = {
    "<UUID>" = {
        PartialPath = "<relative path>";
    };
};
Exclusions = (
    "<path1>",
    "<path2>",
    ...
);

The Stores dictionary maps store UUIDs to their corresponding volume paths. The Exclusions array lists paths explicitly excluded from Spotlight indexing.

Key Fields for Analysis

Shortcut Records

Preference Categories

Disabled categories are forensically interesting -- a user who disables DOCUMENTS from Spotlight results may be attempting to reduce discoverability.

Volume Configuration

Timestamps

Spotlight shortcuts use CFAbsoluteTime (Core Data) timestamps: seconds since 2001-01-01 00:00:00 UTC.

To convert to Unix epoch:

unix_timestamp = cf_absolute_time + 978307200

Where 978307200 is the number of seconds between 1970-01-01 and 2001-01-01.

A value of 0 typically indicates the timestamp is not set.

Analysis Notes

Search Activity Reconstruction

Spotlight shortcuts provide a direct record of user search behaviour. Each shortcut entry records:

• What the user typed (the dictionary key)
• What they selected from the results (DISPLAY_NAME and URL)
• When they last performed that search-to-launch action (LAST_USED)

This can establish that a user was aware of and deliberately accessed specific files or applications at specific times.

Exclusion Analysis

The Exclusions list in VolumeConfiguration.plist and the disabled categories in user preferences can reveal attempts to prevent Spotlight from indexing certain content. Common legitimate exclusions include /tmp, /private/var/vm, and Time Machine backup volumes. Unusual exclusions (such as user document directories or application data folders) warrant further investigation.

Raw Store Analysis

The raw store.db files contain indexed kMDItem metadata properties for every file the Spotlight indexer has processed. This includes:

• File names and paths
• Content types and UTIs
• Creation and modification dates
• File sizes
• Author metadata
• Email addresses and phone numbers (from document content)

Since the metadata store is not immediately purged when files are deleted, it can contain references to files that no longer exist on the filesystem.

Raw store analysis requires external tools (see Tool Support below) as the binary format uses a combination of zlib, LZ4, and LZFSE compression for page data.

Permission Requirements

• User-level shortcuts and preferences are readable by the file owner.
• Volume-level stores at /.Spotlight-V100/ require root access or Full Disk Access (FDA) entitlement.
• The .Spotlight-V100 directory is hidden from Finder by default.

Version Differences

The Store-V2 binary format has remained structurally stable across all supported macOS versions.

Tool Support

References

• spotlight_parser (Yogesh Khatri)
• mac_apt SPOTLIGHTSHORTCUTS
• Apple Spotlight Store Database File Format (libyal/dtformats)
• Apple Developer - Spotlight Metadata Attributes
• Apple Developer - Core Spotlight Framework