Pro plugin

Quarantine Events

Collects macOS Quarantine Events from per-user QuarantineEventsV2 databases tracking downloaded files and their sources

system.quarantinePromacOS 10.5+v1.0.0downloadusersecurity

Run this plugin

Trigger collection for Quarantine Events on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.quarantine --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.quarantine --dry-run

Compatibility

macOS 10.5+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (2 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

downloads

Artifact	Format	Path	Notes
Quarantine Events quarantine_events	sqlite	`~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2` +1 more `~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents`	Download tracking records from quarantine-aware applications (browsers, Mail, AirDrop, Messages).
Quarantine Raw Files quarantine_rawOptionalOpt-in	sqlite	`~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2` +1 more `~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents`	Full quarantine database files for offline analysis.