← All artifacts

Spotlight Metadata

macOS Spotlight search shortcuts, preferences, volume configuration, and opt-in raw index stores.

Status
available
CLI plugin
system.spotlight
Categories
system, filesystem

Overview

Spotlight maintains an index of file metadata across the file system. macfor parses Spotlight search shortcuts, preferences, and volume configuration. It can also copy the raw index stores (opt-in) for offline parsing with tools such as spotlight_parser or mac_apt. macfor does not parse store.db itself.

Analysis Tips

  • Search shortcuts: Show what the user typed into Spotlight and which result they opened
  • Volume configuration: Lists the index stores on the volume and any excluded paths
  • Raw stores: store.db is not SQLite. Parse the opt-in copy with an external tool

Related Artifacts

References

Data sources

com.apple.Spotlight.plist, com.apple.spotlight.ShortcutsPlist

~/Library/Preferences/, ~/Library/Application Support/

Search shortcuts (typed queries and chosen results) and Spotlight preferences

VolumeConfiguration.plistPlist

/.Spotlight-V100/

Index stores and excluded paths for the volume

store.db, dbStr-1.map.*Proprietary binary

/.Spotlight-V100/Store-V2/{UUID}/

Main metadata store (opt-in raw copy, not parsed)

store.dbProprietary binary

~/Library/Metadata/CoreSpotlight/index.spotlightV3/

Per-user CoreSpotlight store with app-contributed data (opt-in raw copy, not parsed)