Get macfor Pro

Pro plugin

Quick Look Thumbnails

Collects Quick Look thumbnail cache metadata, extracted thumbnail images, and raw cache files from macOS

system.quicklookPromacOS 10.15+v1.0.0systemuseractivity

Run this plugin

Trigger collection for Quick Look Thumbnails on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.quicklook --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.quicklook --dry-run

Compatibility

  • macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (3)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

metadata

ArtifactFormatPathNotes
Quick Look Metadata
quicklook_metadatahigh value
sqlite/private/var/folders/*/*/C/com.apple.QuickLook.thumbnailcache/index.sqlite
+1 more
  • /private/var/folders/*/*/C/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/index.sqlite
—

media

ArtifactFormatPathNotes
Quick Look Thumbnail Images
quicklook_thumbnailshigh value
binary/private/var/folders/*/*/C/com.apple.QuickLook.thumbnailcache/thumbnails.data
+1 more
  • /private/var/folders/*/*/C/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/thumbnails.data
Raw BGRA bitmap data extracted and converted to individual PNG files.

cache

ArtifactFormatPathNotes
Quick Look Raw Files
quicklook_rawOptionalOpt-inmedium value
binary/private/var/folders/*/*/C/com.apple.QuickLook.thumbnailcache/
+1 more
  • /private/var/folders/*/*/C/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/
Raw database and data files for analysis with mac_apt, AXIOM, or other tools.