Pro plugin

Quick Look Thumbnails

Collects Quick Look thumbnail cache metadata, extracted thumbnail images, and raw cache files from macOS

system.quicklookPromacOS 10.15+v1.0.0systemuseractivity

Run this plugin

Trigger collection for Quick Look Thumbnails on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.quicklook --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.quicklook --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (3 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

metadata

Artifact	Format	Path	Notes
Quick Look Metadata quicklook_metadatahigh value	sqlite	`/private/var/folders///C/com.apple.QuickLook.thumbnailcache/index.sqlite` +1 more `/private/var/folders///C/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/index.sqlite`macOS 11.0+	—

media

Artifact	Format	Path	Notes
Quick Look Thumbnail Images quicklook_thumbnailshigh value	binary	`/private/var/folders///C/com.apple.QuickLook.thumbnailcache/thumbnails.data` +1 more `/private/var/folders///C/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/thumbnails.data`macOS 11.0+	Raw BGRA bitmap data extracted and converted to individual PNG files.

cache

Artifact	Format	Path	Notes
Quick Look Raw Files quicklook_rawOptionalOpt-inmedium value	binary	`/private/var/folders///C/com.apple.QuickLook.thumbnailcache/` +1 more `/private/var/folders///C/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/`macOS 11.0+	Raw database and data files for analysis with mac_apt, AXIOM, or other tools.