Quarantine Events

Overview

When a user downloads a file with a quarantine-aware application — Safari, Chrome, Mail, AirDrop, Messages, and most email clients — macOS writes a row to the per-user QuarantineEventsV2 SQLite database. The row contains the source URL, the application that performed the download, and a timestamp. For incident responders, this is the single best ground-truth record of "where did this binary come from?"

Analysis Tips

• LSQuarantineEventIdentifier: UUID also written into the file's xattr com.apple.quarantine — links the database row to the on-disk file
• LSQuarantineDataURL vs LSQuarantineOriginURL: Origin is the page that hosted the link; Data is the actual download URL. They often differ in attacker-driven downloads
• LSQuarantineSenderName: Bundle ID of the downloading app — "com.apple.Safari", "com.tinyspeck.slackmacgap", etc.
• LSQuarantineEventTime: Cocoa epoch (seconds since 2001-01-01) — convert with Unix = Cocoa + 978307200
• xattr survival: Even after the database row is gone, files often retain the com.apple.quarantine xattr — check both sources

Related Artifacts

• Safari Browser - Browsing history corroborates the originating URL
• FSEvents - File creation events match the download timestamp
• Persistence Mechanisms - Trace a malicious agent's binary back to its download row

References

• Apple LaunchServices documentation
• SANS macOS forensics — Gatekeeper and quarantine