Get macfor Pro

Pro plugin

Quarantine Events

Collects macOS Quarantine Events from per-user QuarantineEventsV2 databases tracking downloaded files and their sources

system.quarantinePromacOS 10.5+v1.0.0downloadusersecurity

Run this plugin

Trigger collection for Quarantine Events on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.quarantine --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.quarantine --dry-run

Compatibility

  • macOS 10.5+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (2)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

downloads

ArtifactFormatPathNotes
Quarantine Events
quarantine_events
sqlite~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
+1 more
  • ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents
Download tracking records from quarantine-aware applications (browsers, Mail, AirDrop, Messages).
Quarantine Raw Files
quarantine_rawOptionalOpt-in
sqlite~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
+1 more
  • ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents
Full quarantine database files for offline analysis.