macOS QuickLook Cache Leaks Encrypted File Previews

macOS QuickLook caches unencrypted thumbnails and file paths of contents stored in encrypted containers and USB drives, exposing them even after unmounting.

Security researcher Wojciech Reguła, in a guest post on Objective-See, details how macOS's QuickLook feature (via the com.apple.quicklook.ThumbnailsAgent XPC service) persistently caches thumbnails and file paths of previewed files—including those stored in password-protected encrypted containers like VeraCrypt, TrueCrypt, or encrypted HFS+/APFS volumes—in a plaintext SQLite database and data file under the user's temporary directory. This caching can occur automatically simply by viewing a directory in Finder, without the user ever manually invoking a QuickLook preview, and the cached thumbnails often retain enough resolution to discern the original file's contents.

The research demonstrates that this cached data persists even after the encrypted volume is unmounted and survives across reboots, making it accessible to any code running in the user's context, forensic investigators, or an attacker/law-enforcement actor with access to a running (even if the container is unmounted) system. The same behavior extends to removable USB drives, meaning file names and thumbnails from any USB stick ever inserted into the Mac remain recorded indefinitely, which the authors note could serve as a valuable historical record for forensic investigation or surveillance implants.

The post also covers mitigation: Apple's qlmanage utility with the standard -r flag does not clear the cache, but an undocumented 'qlmanage -r cache' flag purges it immediately, and 'qlmanage -r disablecache' can persistently disable QuickLook caching by modifying the com.apple.QuickLookDaemon.plist. This is presented as a privacy/forensics issue rather than an actively exploited vulnerability, with no CVE assigned and no indication of in-the-wild abuse by threat actors.

Source reporting: https://objective-see.org/blog/blog_0x30.html