in macOS Privacy

Your encrypted photos revealed in macOS cache

Quicklook is a super cool mechanism allowing you to quick check file contents without opening it in specialized application. When you press the space bar on for instance *xlsx file, you can see following preview without having MS Excel installed.
While reading *OS Internals Volume I (that I highly recommend btw) I stopped on Quicklook chapter. I found out that Quicklook registers XPC service that is responsible for creating thumbnails database and storing it in /var/folders/.../C/ directory.
It means that all photos that you have previewed using space (or Quicklook cached them independently) are stored in that directory as a miniature and its path. They stay there even if you delete these files or if you have previewed them in encrypted HDD or TrueCrypt/VeraCrypt container.

Proof of Concept

Let's create a VeraCrypt container, mount it and save Luke Skywalker's photo (in my case /Volumes/Container/luke-skywalker.png). Also, press space on it to make QuickLook cache it.
Now we do the same thing, but with placing Darth Vader in macOS Encrypted HFS+/APFS drive (in my case /Volumes/EncryptedHDD/test/darth-vader.jpeg).
Now we should have both images cached. Using following command we can found necessary files:

sM4CBt00Ks:~ r3$ find $TMPDIR../C/ -type f -name "index.sqlite"
sM4CBt00Ks:~ r3$ find $TMPDIR../C/ -type f -name ""

Now, copy them to other location.

sM4CBt00Ks:~ r3$ mkdir ~/Desktop/ql_post/
sM4CBt00Ks:~ r3$ cp /var/folders//d5/5p9d59rs67d59ttncml57pqw0000gp/C/ ~/Desktop/ql_post/
sM4CBt00Ks:~ r3$ cp /var/folders//d5/5p9d59rs67d59ttncml57pqw0000gp/C/ ~/Desktop/ql_post/

Open index.sqlite to investigate the file contents.
We have information about the full paths and the file names. Now, let's exfil the file to retrieve the miniatures. 😈 I used a python script ( with my little modifications to provide macOS compatibility.

sM4CBt00Ks:OSX-QuickLook-Parser r3$ python2 -d /Users/r3/Downloads/OSX-QuickLook-Parser/ -o /Users/r3/Downloads/OSX-QuickLook-Parser/output 
Processing Complete
Records in table: 41
Thumbnails available: 41
Thumbnails extracted: 41

The output directory contains few thumbnail versions of our previews.
Below you can see the original miniatures (the biggest cached by Quicklook).
Enough to determine the encrypted picture contents, isn't it?
Darth Vader photo, in original, has resolution equal 1920x1080 and in cached miniature - 336x182.

This technique is known and helps a lot in forensics, but I honestly didn't know about this before. It was the big surprise for me to see that even files stored in encrypted containers may be that cached. Have it on mind when you will be using space to preview photos. 😉


This blog post was continued in cooperation with Patrick Wardle on

Update 2

The story was also featured in: