Pro plugin

Spotlight Metadata

Collects Spotlight search shortcuts, preferences, volume configuration, and raw metadata stores from macOS

system.spotlightPromacOS 10.15+v1.0.0systemmetadatasearch

Run this plugin

Trigger collection for Spotlight Metadata on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.spotlight --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.spotlight --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (5 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

history

Artifact	Format	Path	Notes
Spotlight Shortcuts spotlight_shortcuts	binary_plist	`~/Library/Preferences/com.apple.Spotlight.plist` +2 more `~/Library/Application Support/com.apple.spotlight.Shortcuts` `~/Library/Application Support/com.apple.spotlight.Shortcuts.v3`	—

config

Artifact	Format	Path	Notes
Spotlight Preferences spotlight_preferences	binary_plist	`~/Library/Preferences/com.apple.Spotlight.plist` +1 more `/Library/Preferences/com.apple.Spotlight.plist`	—
Spotlight Volume Configuration spotlight_volume_config	binary_plist	`/.Spotlight-V100/VolumeConfiguration.plist` +1 more `/System/Volumes/Data/.Spotlight-V100/VolumeConfiguration.plist`	—

metadata

Artifact	Format	Path	Notes
Spotlight Volume Store spotlight_volume_storeOptionalOpt-in	binary	`/.Spotlight-V100/Store-V2//store.db` +1 more `/System/Volumes/Data/.Spotlight-V100/Store-V2//store.db`	Proprietary binary format (NOT SQLite). Use spotlight_parser or mac_apt for offline parsing.
User CoreSpotlight Store spotlight_user_storeOptionalOpt-in	binary	`~/Library/Metadata/CoreSpotlight/index.spotlightV3/store.db`	Same proprietary format as volume store. Contains app-contributed searchable data.