When looking at the table files we see columns for folder and file_name among others.

The Quicklook database has several tables that are valuable to us. You can use a simple find command to locate the database. As you can see the part is the part that varies.The path to the Quicklook thumbnail database is a dynamic path but follows a general path in the table below. In my CEIC presentation in 2014 I briefly talked about the immense value of the Quicklook database and now I’m following up with some information on how to link the thumbnail last visit date with the filenames! I’m a little late to this party but come on, we all have day jobs. If you are interested in thumbnails.cache you can find some information by Simon Key at Guidance here. The second is a cache file “thumbnails.cache” that stores the thumbnails and is also valuable.The first which I’m covering in this post is a SQLite database called “index.sqlite”.When Finder session renders that thumbnail it tracks the thumbnail information in two files. In this post I’m going to talk about the Quicklook database that stores metadata for thumbnails of files you view in the Mac Finder. When reviewing activity from a Mac OSX system there are a number of great artifacts to consider in your investigations.

Sql lite database for mac