Apple - Where is the 'Where from' meta data stored when downloaded via Chrome?

It's stored in an extended attribute on the file. Specifically the com.apple.metadata:kMDItemWhereFroms attribute. It may stay with the file when you move it to different computers, but it depends on the filesystem or file sharing protocol you use. If you move it to another Mac on an HFS+ disk, it will likely keep it, but not necessarily if you transfer over the network, and most likely not with an external disk with a non-HFS+ filesystem.

You can check a file by running xattr -lp com.apple.metadata:kMDItemWhereFroms myfile in the Terminal, or remove it with xattr -d com.apple.metadata:kMDItemWhereFroms my file. ls -l@ flag is also useful; it will list the names of xattrs along with the usual ls information.

If you want to remove it from multiple files, have a look at this question: How to remove xattr com.apple.quarantine from all .webarchive files with that extended attribute?


There are extended attributes assigned to downloaded files, like com.apple.quarantine to put executable files in quarantine and com.apple.metadata:kMDItemWhereFroms for the "Where from" data. The presence of these attributes can be revealed in the Terminal via ls -l@ /path/to/downloaded/file.

Now to get the actual Data stored in this kMDItemWhereFroms, I found a solution based on this answer (which also explains a bit more about the conversion method):

xattr -p com.apple.metadata:kMDItemWhereFroms /path/to/downloaded/file | sed -e 's/0D//g' -e 's/.*\(5F 10\)...//' -e 's/00.*//'| xxd -r -p | sed -e 's@ (.*@@g'

This will return the url. Please note that at this moment it's in a relatively hard to read form, since my command-line-fu seems to fail me. I'll update the answer once I found the proper sed for it.