Quick Look Cache

Overview

Evidence: Quick Look Cache Description: Collect Quick Look Cache Category: System Platform: macos Short Name: qklc Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Quick Look cache stores thumbnails and metadata for recently viewed files. This data is essential for confirming file access and reconstructing user interactions with files.

Data Collected

This collector gathers structured data about quick look cache.

Quick Look Cache Data

Field	Description	Example
Path	Path	Example value
RowID	Row ID	123
FSID	FSID	Example value
VolumeID	Volume ID	123
INode	I Node	123
ModTime	Mod Time	123
Size	Size	123
Label	Label	Example value
LastHitDate	Last Hit Date	123
HitCount	Hit Count	Example value
IconMode	Icon Mode	123
CachePath	Cache Path	Example value

Collection Method

This collector queries the quicklook_cache table via osquery and records cache metadata into quicklook_cache.

Forensic Value

This evidence is crucial for forensic investigations as it indicates files previewed or viewed by a user, even if moved or deleted.