Category Archives: Quicklook

[SQLite] Analysing the Quicklook thumbnail database [MacOS]

When reviewing activity from a Mac OSX system there are a number of great artifacts to consider in your investigations. In this post I’m going to talk about the Quicklook database that stores metadata for thumbnails of files you view in the Mac Finder. When Finder session renders that thumbnail it tracks the thumbnail information

Read More