惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

B
Blog RSS Feed
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
G
GRAHAM CLULEY
Hacker News - Newest:
Hacker News - Newest: "LLM"
C
Cybersecurity and Infrastructure Security Agency CISA
Simon Willison's Weblog
Simon Willison's Weblog
Latest news
Latest news
C
CERT Recently Published Vulnerability Notes
T
Threatpost
V
Vulnerabilities – Threatpost
AWS News Blog
AWS News Blog
Blog — PlanetScale
Blog — PlanetScale
C
Cisco Blogs
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
U
Unit 42
The Register - Security
The Register - Security
T
The Blog of Author Tim Ferriss
Stack Overflow Blog
Stack Overflow Blog
The Hacker News
The Hacker News
AI
AI
Project Zero
Project Zero
Scott Helme
Scott Helme
S
Securelist
Vercel News
Vercel News
GbyAI
GbyAI
S
Security @ Cisco Blogs
I
InfoQ
aimingoo的专栏
aimingoo的专栏
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
C
Check Point Blog
Forbes - Security
Forbes - Security
Google Online Security Blog
Google Online Security Blog
W
WeLiveSecurity
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
H
Heimdal Security Blog
G
Google Developers Blog
D
DataBreaches.Net
The Last Watchdog
The Last Watchdog
D
Docker
MyScale Blog
MyScale Blog
T
Tor Project blog
Cyberwarzone
Cyberwarzone
Recent Announcements
Recent Announcements
Microsoft Security Blog
Microsoft Security Blog
T
Tenable Blog
T
Threat Research - Cisco Blogs
Cisco Talos Blog
Cisco Talos Blog
H
Hackread – Cybersecurity News, Data Breaches, AI and More
博客园 - 聂微东
月光博客
月光博客

Comments for The Eclectic Light Company

Should you try Golden Gate beta? Solutions to Saturday Mac riddles 367 In the shadow: Diego Velázquez Comment on Last Week on My Mac: Freshen up your documents by David Comment on Happy 250th birthday America 2 by mac Happy 250th birthday America 1 Brushstrokes: Portraits 1760-1877 Spotlight and Core Spotlight are different Comment on Sort order, collation and the Finder by eyelessjerry Comment on Apple has just released macOS 26.5.2 Tahoe by Derek Currie Great Ladies of Impressionism: Marie Bracquemond Comment on Get more from your Mac’s log by extending its duration by John Gilbert Comment on Keep your Mac cool using physics by F Portraits of trees: Coppices and pollards Comment on Firmware has become complicated again by John Woods Comment on Logistician 1.2 fixes a couple of bugs by info395288a4d1d Comment on What does Activity Monitor measure? by hoakley Last Week on My Mac: Spotlight on semantics An American in Paris: paintings of Henry Ossawa Tanner 1902-1930 An American in Paris: paintings of Henry Ossawa Tanner 1880-1902 Great Ladies of Impressionism: Berthe Morisot 1874-1891 What to do with a hot Mac Deprecations and removals from Golden Gate Brushstrokes: From El Greco to Rembrandt Portraits of trees: Dutch Golden Age How to get the most from SilentKnight 3 Comment on Hero or hooligan: Achilles becomes the warrior by Deborah J. Brasket Solutions to Saturday Mac riddles 365 Comment on SilentKnight 3.0 for Apple silicon Macs running Sequoia and later (full release) by michaelriccioli Comment on Last Week on My Mac: Uncompressed compressed files by fds Comment on Explainer: Memory by jzonedotcom Comment on Colin Campbell Cooper painting America: 1896-1910 by House of Heart Brushstrokes: 16th century What can you do when an app uses too much memory? SilentKnight 3 second beta adds text and JSON reporting In the shadow: Caravaggism What to do with your encrypted HFS+ disks First beta-test version of SilentKnight 3 for Apple silicon Macs Hero or hooligan: Jason and Medea Comment on Fix documents that won’t open as expected using Quarant2 by EcleX Last Week on My Mac: The mystery of Safari’s Web Archives Last Week on My Mac: Why is it so hard to open a document? Explainer: Disk encryption In the shadow: Caravaggio Brushstrokes: innovators of the first century Changing Paintings: 36 Theseus and the Minotaur macOS virtualisation is leaping forward in Golden Gate Why can’t Preview open that PDF? Crossing the Golden Gate, Intel support, and an update to SystHist Reading the Finder’s Get Info dialog In memoriam Mary Cassatt: 2, 1880-81 Last Week on My Mac: What’s in a name? Explainer: Getting a location Get more from Get Info and the Finder’s contextual menu Stop your photos revealing your location Have you saved thousands of versions? Versatility 1.2 might be what you need Apple has released an update to XProtect for all macOS Apple has released macOS Tahoe 26.5.1 Comment on What Location Services do in macOS by Tristan Hubsch Comment on Protect files with the Locked or Immutable flag by markbot2zero Portraits of trees: Introduction Which tasks require mains power? Comment on Online reference to external displays for Apple silicon Macs by Brian What’s in that phishing email? How to search document versions Rubens’ Peace and War Comment on Last Week on My Mac: Syncing metadata in iCloud Drive by hoakley A weekend with Misia: 2 How to search Time Machine backups? Medium and message: Pottery Hero or hooligan: Theseus and the sandals How QuickLook provides thumbnails and previews Hunting extended attributes with an update to xattred Saturday Mac riddles 360 Comment on How to preserve versions, and how to create versioned PDFs by markbot2zero Comment on What gets synced in iCloud Drive? by hoakley Solutions to Saturday Mac riddles 359 Last Week on My Mac: snapshots, the elephant in APFS macOS Tahoe no longer fully supports Time Capsules The bicentenary of Frederic Edwin Church: 1857-77 macOS virtual machines and audio-video syncing Comment on Use Finder tags for categories by Chuck Last Week on My Mac: Dependency and skill fade Comment on Virtualisation on Apple silicon Macs is different by AndyS Painting Pandora and her box: 1883-1919 Mac Easter eggs Painting Spring blossom 2 Comment on The macOS Natural Language framework and Nalaprop by Ingo Comment on The MACL extended attribute by hoakley On Reflection: Cézanne Privacy: Which folders are protected in Tahoe? Last Week on My Mac: Root cause analysis and ClickFix Last Week on My Mac: Root cause analysis and ClickFix Last Week on My Mac: Root cause analysis and ClickFix Last Week on My Mac: Root cause analysis and ClickFix Why you can’t trust Privacy & Security How can I now have two apps named Pages? How to survive the loss of Rosetta Use Fallback Recovery on Apple silicon Macs Clean install macOS
How to check whether Spotlight is getting the right metadata
hoakley · 2026-05-08 · via Comments for The Eclectic Light Company

Spotlight can only search the metadata it has entered in its indexes. As I demonstrated a couple of days ago in two test cases, some metadata may be present in a file and available for indexing, but may not be added to those indexes. This normally occurs because of a problem or bug in the mdimporter responsible for extracting metadata and passing it for storage in the indexes. Fortunately, macOS provides a method of identifying that, using two command tools.

Commands

The first command
mdimport -t -d2 filename
lists all its known metadata recognised by the mdimporter used. Currently, that may crash persistently for some types of file such as images.

The second command
mdls filename
lists all indexed metadata for that file, and shouldn’t crash.

mdimport – aspirations

Output from mdimport is a long catalogue of all the metadata attached to and associated with that file. This starts with a statement of the file examined, tells you its type as a UTI, and reveals which mdimporter was used:
Imported '/Users/hoakley/Documents/0xattrtests/testtext1.text' of type 'public.plain-text' with plugIn /System/Library/Spotlight/RichText.mdimporter.

It then tells you how many metadata attributes it found
35 attributes returned

Those are listed, starting with those found in extended attributes, prefaced by :EA:
":EA:kMDItemLastUsedDate" = "2026-05-04 18:52:32 +0000";

Then come standard file metadata
":MD:kMDItemPath" = "/Users/hoakley/Documents/0xattrtests/testtext1.text";
"_kMDItemContentChangeDate" = "2026-05-04 11:34:50 +0000";

The main body lists all the rest with the prefix kMDItem common to metadata
kMDItemContentCreationDate = "2026-05-04 11:34:49 +0000";

Among those are the UTI of the file, and its more general types in the UTI tree. These can explain why a file appears to have been processed by the wrong mdimporter
kMDItemContentType = "public.plain-text";
kMDItemContentTypeTree = ("public.plain-text", "public.text", "public.data", "public.item", "public.content");

There’s a long series of entries giving the long form of the file type in multiple languages
kMDItemKind = {en = "Plain Text Document"; };

Text content that has been indexed isn’t given in this form of the command, but a summary is:
kMDItemTextContent = "<<< Text content of 4968 characters >>>";

Those are the metadata that should then be passed to Spotlight to be stored in its indexes, but not necessarily what does get stored. To discover that, we need the mdls output. Note that additional metadata obtained by mediaanalysisd and the CGPDF Service aren’t included in this, as they operate separately from mdimporters and normally after significant delay.

mdls – reality

This output is far shorter, and contains entries in Spotlight’s indexes for that file, except for indexed text content. The only way to assess that is by searching for text it should contain.

This should match metadata attributes seen in the mdimport output, such as
_kMDItemDisplayNameWithExtensions = "testtext1.text"
kMDItemContentCreationDate = 2026-05-04 11:34:49 +0000
kMDItemContentType = "public.plain-text"
kMDItemKind = "Plain Text Document"

Examples

Plain text file with extended attributes

mdimport:
“:EA:kMDItemAuthors” = “Andy Bill Charlie”;
“:EA:kMDItemComment” = “A. regular comment.”;
“:EA:kMDItemDescription” = “A description.”;
“:EA:kMDItemKeywords” = “keyword1,ketwird2,keyword3”;
“:EA:kMDItemSubject” = “The subject.”;

mdls:
kMDItemAuthors = (“Andy Bill Charlie”)
kMDItemComment = “A. regular comment.”
kMDItemDescription = “A description.”
kMDItemKeywords = (“keyword1,ketwird2,keyword3”)
kMDItemSubject = “The subject.”

Metadata attributes were faithfully added to Spotlight’s indexes.

RTF file with extended attributes

mdimport:
“:EA:kMDItemAuthors” = “Andy Bill Charlie”;
“:EA:kMDItemComment” = “A. regular comment.”;
“:EA:kMDItemDescription” = “A description.”;
“:EA:kMDItemKeywords” = “keyword1,ketwird2,keyword3”;
“:EA:kMDItemSubject” = “The subject.”;
kMDItemAuthors = “<null>”;
kMDItemComment = “<null>”;
kMDItemKeywords = “<null>”;
kMDItemSubject = “<null>”;

The last four are those obtained from the (absent) Info metadata embedded in the file data, and conflict with those from four of the extended attributes.

mdls:
kMDItemComment = “A. regular comment.”
kMDItemDescription = “A description.”
kMDItemKeywords = (“keyword1,ketwird2,keyword3”)
kMDItemSubject = “The subject.”

These reveal that Spotlight’s indexes captured four of the five extended attributes, and ignored the null values for the Info metadata. However, kMDItemAuthors is missing, presumably because of a bug in the mdimporter.

I’m considering whether it might be useful to add these to SpotTest, to help diagnose problems.