What Trailsift checks

Trailsift looks through the places where a Mac keeps records of what you browse, download and view. This page lists every one of them: what it is, why it matters, how to clear it yourself without the app, and where to read more.

The checks are done by a plain shell script inside the app, and the explanations here are the same ones the app shows next to each finding.

It only readsThe audit never deletes, moves or changes anything. Databases are copied to a private temporary folder before they are read, and that folder is removed when the audit ends.
Counts, not contentsThe report shows how many items there are, their size and their date range. It doesn't show web addresses or file names unless you run a word search.
Nothing leaves your MacNo accounts and no analytics. Results stay on this Mac unless you save or copy them.

Disk protection

What it is

FileVault encrypts your whole startup disk, so its contents can't be read without your password.

Why it matters

With FileVault on, files deleted from an SSD can't be brought back with recovery tools. That means what matters is the data that still exists in the places below, not what was deleted before.

What to do

Turn it on in System Settings > Privacy & Security > FileVault. Encryption runs in the background while you use the Mac.

Where the app looks

The output of fdesetup status

Source: Apple Support, Protect data on your Mac with FileVault

Download history (LaunchServices quarantine log)

What it is

When an app downloads a file, macOS marks it so Gatekeeper can check it before it first opens. It also logs every download in a small database: the date, the app that downloaded it, and the web address it came from.

Why it matters

Clearing your browser history does not touch this log, so it can list downloads going back years. Entries made by AirDrop and Messages are files other people sent you.

Clear it by hand

Quit your browsers, then run this in Terminal to delete the entries. The database itself stays, and macOS keeps adding new downloads to it:

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'delete from LSQuarantineEvent'

Where the app looks

~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

Source: The Eclectic Light Company, articles on the quarantine log

Safari

What it is

History.db records every page visit. The favicon cache keeps the small icons of sites you visited. The last session and recently closed tabs let Safari reopen your tabs, and the cache holds copies of images and pages you loaded.

Why it matters

The favicon cache and saved sessions can outlive a history clear, and together they show which sites were visited and when.

Clear it by hand

In Safari, choose History > Clear History, and pick "all history". This removes history, cookies and most cached data.
Safari > Settings > Privacy > Manage Website Data > Remove All clears what websites stored.
If the favicon cache or session files remain, quit Safari and move them to the Trash.

Where the app looks

~/Library/Safari/History.db
~/Library/Safari/Downloads.plist
~/Library/Safari/Favicon Cache
~/Library/Safari/LastSession.plist and RecentlyClosedTabs.plist
~/Library/Containers/com.apple.Safari/Data/Library/Caches

Safari's folder is protected by macOS, so the app needs Full Disk Access to read it.

Source: Apple Support, Clear your browsing history in Safari

Chrome-family browsers

What it is

Chrome, Chrome Beta, Brave, Edge, Arc, Vivaldi, Chromium and Opera share one design. Each profile has a History database (visits and downloads), Favicons (site icons) and Sessions (tabs to restore). The disk cache holds copies of images and pages you loaded.

Why it matters

Every profile keeps its own history, so a browser with several profiles has several records. The cache lives in a separate folder from the profile.

Clear it by hand

In the browser, press Shift-Command-Delete, or open Settings > Privacy and security > Delete browsing data. Choose "All time" and tick browsing history, download history and cached images and files. Repeat for each profile.

Where the app looks

~/Library/Application Support/Google/Chrome/profile/History, Favicons and Sessions, and the matching folders for the other browsers
~/Library/Caches/Google/Chrome, and the matching folders for the other browsers

Source: Google Chrome Help, Delete browsing data in Chrome

Firefox

What it is

places.sqlite holds history, bookmarks and the downloads list. favicons.sqlite holds site icons, the session store keeps your open tabs, and the cache holds copies of pages and images.

Why it matters

Downloads and history live in the same database as your bookmarks, and each Firefox profile has its own copy.

Clear it by hand

In Firefox, press Shift-Command-Delete, or open Settings > Privacy & Security > History > Clear History. Choose "Everything" and select history, downloads and cache.

Where the app looks

~/Library/Application Support/Firefox/Profiles/profile/places.sqlite
favicons.sqlite and sessionstore-backups in the same profile folder
~/Library/Caches/Firefox

Source: Mozilla Support, Delete browsing, search and download history on Firefox

Tor Browser

What it is

Tor Browser runs in permanent private browsing, so it normally saves no history. Its profile still keeps bookmarks, site icons and settings, including the last folder you saved a download to. Its Tor folder records network state, and the time that file was last written is roughly the last time Tor Browser was used.

Why it matters

Dragging the app to the Trash leaves the TorBrowser-Data folder behind. macOS also keeps its own records of the app: the download log, saved window state and the Dock.

Clear it by hand

To remove Tor Browser completely, delete the app and the TorBrowser-Data folder, as the Tor manual describes.
Delete its saved window state folder, and its installer from Downloads.
Its downloads stay in the macOS download log; see Download history.

Where the app looks

~/Library/Application Support/TorBrowser-Data, including Tor/state and each profile's prefs.js
~/Library/Caches/TorBrowser-Data
~/Library/Saved Application State/org.torproject.torbrowser.savedState
The download log, Tor installers in ~/Downloads, and the Dock

Source: Tor Browser User Manual, Uninstalling

Thumbnails and previews

What it is

When Finder shows a file's icon preview, or you press Space to look at a file, macOS saves a small thumbnail in a hidden system cache.

Why it matters

Thumbnails stay after the original file is deleted, so this cache can hold small copies of pictures that are gone.

Clear it by hand

Run qlmanage -r cache in Terminal. It resets the thumbnail cache, and macOS rebuilds it as you browse.

Where the app looks

com.apple.QuickLook.thumbnailcache in your user cache folder, which getconf DARWIN_USER_CACHE_DIR prints

Source: The Eclectic Light Company, articles on the Quick Look thumbnail cache

Recent items and window state

What it is

macOS keeps lists of recently used documents, apps and servers: Apple menu > Recent Items, and File > Open Recent in each app. Finder separately remembers recent folders. Saved Application State is macOS Resume: when an app quits, its open windows are saved so they come back next time.

Why it matters

For browsers, saved window state can include window titles, which are page titles. Recent lists name files you opened, even after the files are gone.

Clear it by hand

Apple menu > Recent Items > Clear Menu.
In each app, File > Open Recent > Clear Menu.
In Finder, Go > Recent Folders > Clear Menu.
Quit an app with Option-Command-Q to close its windows without saving them, or turn on "Close windows when quitting an application" in System Settings > Desktop & Dock. Saved state for an app that's quit can be moved to the Trash.

Where the app looks

~/Library/Application Support/com.apple.sharedfilelist
Finder's FXRecentFolders setting
~/Library/Saved Application State

Sources: The Eclectic Light Company on recent items and on Saved Application State

Media players

What it is

VLC and IINA keep their own recently played lists, and IINA also caches thumbnails for its timeline previews.

Why it matters

These lists are separate from the macOS recent items, so clearing one doesn't clear the other.

Clear it by hand

In VLC, File > Open Recent > Clear Menu.
In IINA, the Utilities pane of its settings has buttons to clear its playback history and thumbnail cache.

Where the app looks

~/Library/Preferences/org.videolan.vlc.plist
~/Library/Application Support/com.colliderli.iina

Source: VideoLAN, VLC media player and IINA

Photos and messaging

What it is

Photos keeps deleted items in Recently Deleted for 30 days before removing them, and Hidden items stay in the library. Messages, WhatsApp, Telegram, Signal and Discord store photos and videos you send or receive as ordinary files, apart from the chats.

Why it matters

Deleting a conversation doesn't always remove its media, and a photo you deleted is still in the library for a month.

Clear it by hand

In Photos, open Recently Deleted under Utilities in the sidebar and choose Delete All. Review the Hidden album there too.
For Messages, System Settings > General > Storage lists large attachments you can delete. Deleting a conversation in Messages removes its attachments.
For the other apps, delete media from inside the app, through the chat or the app's storage settings. Deleting their files directly can confuse the app.

Where the app looks

The Photos library database, in ~/Pictures/Photos Library.photoslibrary
~/Library/Messages/Attachments
~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/Message/Media
Telegram's folder in ~/Library/Group Containers
~/Library/Application Support/Signal/attachments.noindex
~/Library/Application Support/discord/Cache

Source: Apple Support, Delete and recover photos and videos

Trash and Downloads

What it is

The Trash holds what you deleted until it's emptied. Downloads holds everything browsers and apps saved there.

Why it matters

Files in the Trash still exist, and the Downloads folder is often never cleared. The app counts the images and videos in it.

Clear it by hand

In Finder, choose Finder > Empty Trash.
Go through Downloads and delete what you no longer need.
System Settings > General > Storage can empty the Trash automatically after 30 days.

Where the app looks

~/.Trash
~/Downloads

Source: Apple Support, Optimize storage space on your Mac

Activity databases (Screen Time, Siri, app usage)

What it is

These databases power Screen Time, Siri Suggestions and other on-device intelligence. knowledgeC.db is the older one: which app was in front and for how long, when the Mac was locked and unlocked, what media was playing and, with Screen Time on, which websites were used. Biome is Apple's newer system for the same job. It stores activity as many small stream files, one stream per kind of event, and in macOS 26 Tahoe a new stream records the name of every menu command you choose.

Why it matters

They are some of the most detailed records on a Mac, and forensic examiners use them to rebuild a timeline of what was used and when. Some Biome streams sync to your other devices through iCloud.

What to do

These belong to macOS and aren't meant to be deleted by hand, and doing so can break Screen Time and Siri. You can limit what's collected: turn off Screen Time in System Settings > Screen Time, or turn off "Share across devices" there, and review the Siri settings in System Settings.

Where the app looks

~/Library/Application Support/Knowledge/knowledgeC.db
~/Library/Biome

Sources: Apple Support, Set up Screen Time, Bob Rudis on knowledgeC and Palo Alto Networks Unit 42 on Biome

Copies elsewhere

What it is

Deleting a file on this Mac doesn't delete copies elsewhere. With iCloud Desktop & Documents on, those two folders also live in iCloud and on your other devices, and Safari, Photos and Messages can sync too. Time Machine backups and local snapshots keep files as they were when the backup was made.

Why it matters

A file you deleted here can still be in a backup, in iCloud or on your iPhone.

What to do

Check what syncs in System Settings > your name > iCloud.
To remove an item from Time Machine, open its folder, enter Time Machine, select the item and choose Delete All Backups of it from the action menu.
Local snapshots are removed automatically after about 24 hours.

Where the app looks

Whether iCloud is signed in, and whether iCloud Desktop & Documents is on
tmutil destinationinfo, tmutil latestbackup and tmutil listlocalsnapshots /

Sources: Apple Support, iCloud Drive Desktop and Documents and Apple Support, Time Machine

Deep scan: images and videos outside the Photos library

What it is

An optional, slower check that finds image and video files outside the Photos library and lists the 20 busiest folders. Visible folders come from the Spotlight index. Library and hidden folders are checked by reading each file's first few bytes, so images saved without a file extension are found too.

Why it matters

Apps keep pictures in caches and hidden folders that you'd never browse to in Finder.

What to do

Open each folder from the report and look at what's there before deleting anything. Files inside an app's own folders are often its working data.

Where the app looks

Your home folder. iCloud, cloud-storage folders and Mail are skipped so nothing downloads.

Word Search

What it is

Word Search looks for words you type, instead of running the audit. It searches browser histories, browser download lists, the macOS download log, file and folder names, and the text of documents Spotlight has indexed.

Why it matters

The audit counts; Word Search shows where a particular thing appears. The app ships with no list of words, and it doesn't read the text of Messages or Notes.

Where the app looks

The browser and download databases listed above
File and folder names in your home folder: visible folders through Spotlight, and Library and hidden folders directly. Developer tool folders and app caches, whose files have generated names, are skipped.
Document text through Spotlight