A–Z
Glossary
Plain-language definitions of the terms used across the blog and the tool.
- App Translocation
- macOS runs a quarantined app launched from an unexpected location from a randomized read-only mount under an AppTranslocation path.
- AppleDouble (._ files)
- The ._name companion files macOS writes on volumes without extended attributes, such as exFAT, FAT or SMB, to keep a file's xattrs.
- Gatekeeper
- The macOS check, implemented by syspolicyd, that assesses quarantined code at first launch: signature, Developer ID, notarization, XProtect.
- kMDItemWhereFroms
- The com.apple.metadata:kMDItemWhereFroms attribute: a binary plist array of strings, usually the download URL and the referring page.
- .LastGKReject
- A property list syspolicyd writes when Gatekeeper refuses an item. Only the last rejection is kept: time, bookmark and malware type.
- Mac absolute time
- Seconds since 2001-01-01 00:00:00 UTC, the epoch used by LSQuarantineTimeStamp. Add 978307200 to convert it to Unix time.
- Quarantine attribute (com.apple.quarantine)
- The com.apple.quarantine extended attribute on downloaded files: flags, hex time, agent name and a UUID that joins to the database.
- Quarantine flags
- The hexadecimal bit field that opens a com.apple.quarantine value. Apple does not document it; known bits come from open-source code.
- QuarantineEventsV2
- The per-user LaunchServices SQLite database that logs downloads made by quarantine-aware apps: time, agent, URLs and an event UUID.
- SQLite freeblock
- A chunk of unused space inside a SQLite b-tree page, chained in a list. Deleted records often survive in freeblocks until overwritten.
- SQLite write-ahead log (WAL)
- The -wal companion file where SQLite in WAL mode appends changed pages as frames before a checkpoint copies them into the database.
- User-approved flag (0x0040)
- Bit 0x0040 in the com.apple.quarantine flags, set when the user approves or overrides a Gatekeeper decision for a downloaded item.
- XProtect
- Apple's built-in anti-malware check, one of the tests Gatekeeper runs on the first launch of quarantined code on macOS.