Quick Look Thumbnails
Quick Look thumbnail cache containing thumbnail metadata, file access records, and extracted bitmap images from previewed files.
- Status
- available
- CLI plugin
- system.quicklook
- Categories
- system, filesystem
Overview
Quick Look maintains a cache of thumbnail images for files the user has previewed. This cache persists after files are deleted, making it valuable for proving a file once existed on the system. The collector extracts thumbnail metadata and converts raw BGRA bitmap data to standard PNG images.
Analysis Tips
- Deleted file evidence: Thumbnails may persist after the original file is deleted
- File access patterns: Hit counts and last access dates reveal which files were previewed
- Schema versions: Three schemas exist — Legacy (macOS 10.14 and earlier with full file paths), v10 (macOS 10.15+ with APFS inode IDs), and v11 (macOS 12+ with binary plist bitmap format)
- DataVault protection: On macOS 10.14+, the cache is DataVault-protected; accessible on disk images but may block live collection
- Bitmap conversion: Raw data is BGRA format (32-bit, 4 channels);
bytesperrowmay exceedwidth × 4due to alignment padding
Schema Versions
| Schema | macOS | File Path Data |
|---|---|---|
| Legacy | ≤ 10.14 | Full file paths preserved (folder + file_name) |
| v10 | 10.15+ | APFS inode IDs only (fileId) |
| v11 | 12+ | APFS inode IDs with binary plist bitmap format |
Related Artifacts
- FSEvents - File operations that may trigger thumbnail generation
- Spotlight Metadata - File metadata from the Spotlight index
References
Data sources
/var/folders/{xx}/{hash}/C/com.apple.QuickLook.thumbnailcache/
Thumbnail metadata: file references, hit counts, last access dates
/var/folders/{xx}/{hash}/C/com.apple.QuickLook.thumbnailcache/
Uncompressed thumbnail pixel data
/var/folders/{xx}/{hash}/C/com.apple.QuickLook.thumbnailcache/
Schema version indicator (e.g., resetdb_v11)