{"id":13993961,"url":"https://github.com/ydkhatri/spotlight_parser","last_synced_at":"2025-07-22T18:32:43.154Z","repository":{"id":47369049,"uuid":"142299660","full_name":"ydkhatri/spotlight_parser","owner":"ydkhatri","description":"Read and extract data from macOS spotlight databases","archived":false,"fork":false,"pushed_at":"2025-04-20T13:45:00.000Z","size":95,"stargazers_count":108,"open_issues_count":2,"forks_count":13,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-04-20T14:41:13.838Z","etag":null,"topics":["forensics","macos","spotlight"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ydkhatri.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-07-25T12:53:05.000Z","updated_at":"2025-04-20T13:45:03.000Z","dependencies_parsed_at":"2024-11-29T15:33:26.072Z","dependency_job_id":"7bd05d85-7376-482d-ac1b-0ea7d2f37e12","html_url":"https://github.com/ydkhatri/spotlight_parser","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/ydkhatri/spotlight_parser","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ydkhatri%2Fspotlight_parser","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ydkhatri%2Fspotlight_parser/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ydkhatri%2Fspotlight_parser/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ydkhatri%2Fspotlight_parser/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ydkhatri","download_url":"https://codeload.github.com/ydkhatri/spotlight_parser/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ydkhatri%2Fspotlight_parser/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266552498,"owners_count":23947174,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-22T02:00:09.085Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["forensics","macos","spotlight"],"created_at":"2024-08-09T14:02:38.692Z","updated_at":"2025-07-22T18:32:42.841Z","avatar_url":"https://github.com/ydkhatri.png","language":"Python","readme":"# spotlight_parser\nThis code reads and extracts data from spotlight databases present on macOS and iOS.  \n\n## License\nGPL v3\n\n## Latest version\n1.0.2 - Download [here](https://github.com/ydkhatri/spotlight_parser/releases)\n\n_**It is recommended to use the mac_apt_artifact_only script/exe (from [mac_apt](https://github.com/ydkhatri/mac_apt)) instead of this project as that uses this same code, but also offers a few extra features like SQLITE output, and creating separate views for ios apps.**_\n\n## Dependencies  \nIf running from code, you will need python 3.7 and the following python packages installed:\n\n* lz4\n* pyliblzfse\n\nThese can be installed using the command `pip3 install lz4 pyliblzfse`\n\n## Usage\n\nThis script will process individual Spotlight database files which are always named `store.db` and `.store.db`. You will need to provide a path to this file and an output path, with syntax as shown below.\n\n`spotlight_parser.py [-p OUTPUT_PREFIX] \u003cpath_to_database\u003e  \u003coutput_folder\u003e`\n\nExample:  \n`python spotlight_parser.py c:\\spot\\store.db c:\\output`\n\n## Spotlight database locations and types\nOn macOS, under each volume at location `/.Spotlight-V100/Store-V2/\u003cUUID\u003e` where `\u003cUUID\u003e` represents a store id, you should find files named `store` and `.store` which are the Spotlight databases. Provide these as input to this script.\n\nSince macOS 10.13, there are also spotlight databases for each user under `~/Library/Metadata/CoreSpotlight/index.spotlightV3/` \n\niOS spotlight databases are also supported now. These can be found here:\n* /private/var/mobile/Library/Spotlight/CoreSpotlight/NSFileProtectionComplete/index.spotlightV2\n* /private/var/mobile/Library/Spotlight/CoreSpotlight/NSFileProtectionCompleteUnlessOpen/index.spotlightV2\n* /private/var/mobile/Library/Spotlight/CoreSpotlight/NSFileProtectionCompleteUntilFirstUserAuthentication/index.spotlightV2\n\nFor iOS databases, you will also need to have the files that begin with `dbStr` (which are available \nin the same folder as store.db). These files are specific to that instance of store.db. Ideally, just extract the whole folder (instead of a single file). \n\n## Spotlight resources by me\n- [Paper - Investigating spotlight internals to extract metadata](https://www.sciencedirect.com/science/article/pii/S1742287618300860)  \n- [Slides from NW3C presentation on Spotlight](https://github.com/ydkhatri/Presentations/blob/master/NW3C%20Spotlight%20on%20iOS%20and%20macOS-%20December%202020.pdf)\n\n## Thanks  \nMason Bartle for porting the code to python3.\n","funding_links":[],"categories":["Python"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fydkhatri%2Fspotlight_parser","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fydkhatri%2Fspotlight_parser","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fydkhatri%2Fspotlight_parser/lists"}