OS X - Get File Info

On an OS X/macOS system, you may be able to determine a file's origin, i.e., where it was downloaded from, by right-clicking on the file, or clicking on it to highlight it and then hitting command-I (the command and "I" keys), in the Finder and choosing Get Info. If a "where from" field is displayed, you can see the URL from which the file was obtained if it was downloaded from a website.

$ mdls ~/Downloads/14-37-1-PB.pdf
kMDItemAuthors                 = (
    "\U5c71\U7530 \U4eae"
)
kMDItemContentCreationDate     = 2016-11-15 14:48:56 +0000
kMDItemContentModificationDate = 2016-11-15 14:48:56 +0000
kMDItemContentType             = "com.adobe.pdf"
kMDItemContentTypeTree         = (
    "com.adobe.pdf",
    "public.data",
    "public.item",
    "public.composite-content",
    "public.content"
)
kMDItemCreator                 = " Word용 Acrobat PDFMaker 10.0"
kMDItemDateAdded               = 2016-11-15 14:48:56 +0000
kMDItemDisplayName             = "14-37-1-PB.pdf"
kMDItemDownloadedDate          = (
    "2016-11-15 14:48:56 +0000"
)
kMDItemEncodingApplications    = (
    "Adobe PDF Library 10.0"
)
kMDItemFSContentChangeDate     = 2016-11-15 14:48:56 +0000
kMDItemFSCreationDate          = 2016-11-15 14:48:56 +0000
kMDItemFSCreatorCode           = ""
kMDItemFSFinderFlags           = 0
kMDItemFSHasCustomIcon         = (null)
kMDItemFSInvisible             = 0
kMDItemFSIsExtensionHidden     = 0
kMDItemFSIsStationery          = (null)
kMDItemFSLabel                 = 0
kMDItemFSName                  = "14-37-1-PB.pdf"
kMDItemFSNodeCount             = (null)
kMDItemFSOwnerGroupID          = 1286109195
kMDItemFSOwnerUserID           = 723184451
kMDItemFSSize                  = 427284
kMDItemFSTypeCode              = ""
kMDItemKind                    = "Adobe PDF document"
kMDItemLogicalSize             = 427284
kMDItemNumberOfPages           = 8
kMDItemPageHeight              = 792
kMDItemPageWidth               = 612
kMDItemPhysicalSize            = 430080
kMDItemSecurityMethod          = "None"
kMDItemVersion                 = "1.6"
kMDItemWhereFroms              = (
    "http://journals.sfu.ca/apan/index.php/apan/article/download/14/5",
    "https://www.google.com/"
)
$

Or, if I wanted to just see the URL for the location from which I originally obtained the file, in case I wanted to check for an update to it, I could pipe the output into the grep command and look at just the line where "WhereFroms" occurred and the two lines after it.

$ mdls ~/Downloads/14-37-1-PB.pdf | grep -A 2 WhereFroms
kMDItemWhereFroms              = (
    "http://journals.sfu.ca/apan/index.php/apan/article/download/14/5",
    "https://www.google.com/"
$

$ mdls -name kMDItemWhereFroms ~/Downloads/14-37-1-PB.pdf
kMDItemWhereFroms = (
    "http://journals.sfu.ca/apan/index.php/apan/article/download/14/5",
    "https://www.google.com/"
)
$

In the above example, there are two URLs. The second one is for Google. That's because I searched for the document by going to www.google.com in the browser. When I redownloaded the file with the Safari web browser by using the Bing search engine at www.bing.com and searching on "Using abnormal TTL values to detect malicious packets" and then clicking on the link that was returned for the document, I then saw www.bing.com listed as the second URL.

$ mdls -name kMDItemWhereFroms ~/Downloads/14-37-1-PB.pdf
kMDItemWhereFroms = (
    "http://journals.sfu.ca/apan/index.php/apan/article/download/14/5",
    "https://www.bing.com/"
)
$

If I download the files with Safari, I see the URLs listed, but if I download files with Firefox ESR 45.8.0 on my MacBook Pro laptop running OS X El Capitan (10.11.6), I don't see the download URL listed. Instead, I see "null" listed.

$ mdls -name kMDItemWhereFroms ~/Downloads/14-37-1-PB_2.pdf kMDItemWhereFroms = (null)
$

When I tested with Chrome Version 59.0.3071.115 (Official Build) (64-bit), I found it does save that metadata information on the downloaded file. E.g., when I searched on the same terms using DuckDuckGo to perform the search in the Chrome browser, I saw the following:

$ mdls -name kMDItemWhereFroms ~/Downloads/14-37-1-PB\ \(1\).pdf
kMDItemWhereFroms = (
    "http://journals.sfu.ca/apan/index.php/apan/article/download/14/5",
    "https://duckduckgo.com/"
)
$

Another command that can be used to display the information on the location from which the file was downloaded is the xattr command. The command "can be used to display, modify or remove the extended attributes of one or more files, including directories and symbolic links. Extended attributes are arbitrary metadata stored with a file, but separate from the filesystem attributes (such as modification time or file size)." E.g.:

$ xattr -lp com.apple.metadata:kMDItemWhereFroms ~/Downloads/14-37-1-PB.pdf
com.apple.metadata:kMDItemWhereFroms:
00000000  62 70 6C 69 73 74 30 30 A2 01 02 5F 10 40 68 74  |bplist00..._.@ht|
00000010  74 70 3A 2F 2F 6A 6F 75 72 6E 61 6C 73 2E 73 66  |tp://journals.sf|
00000020  75 2E 63 61 2F 61 70 61 6E 2F 69 6E 64 65 78 2E  |u.ca/apan/index.|
00000030  70 68 70 2F 61 70 61 6E 2F 61 72 74 69 63 6C 65  |php/apan/article|
00000040  2F 64 6F 77 6E 6C 6F 61 64 2F 31 34 2F 35 5F 10  |/download/14/5_.|
00000050  15 68 74 74 70 73 3A 2F 2F 77 77 77 2E 62 69 6E  |.https://www.bin|
00000060  67 2E 63 6F 6D 2F 08 0B 4E 00 00 00 00 00 00 01  |g.com/..N.......|
00000070  01 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00 66                       |........f|
00000089
$

If you want to delete the information for the extended attribute, you can substitute the -d option for -lp in the xattr command. E.g.:

$ mdls -name kMDItemWhereFroms ~/Downloads/14-37-1-PB.pdf
kMDItemWhereFroms = (
    "http://journals.sfu.ca/apan/index.php/apan/article/download/14/5",
    "https://www.bing.com/"
)
$ xattr -d com.apple.metadata:kMDItemWhereFroms ~/Downloads/14-37-1-PB.pdf
$ mdls -name kMDItemWhereFroms ~/Downloads/14-37-1-PB.pdf
kMDItemWhereFroms = (null)
$