TrailSift

What TrailSift checks

What TrailSift checks

TrailSift looks through the places where a Mac keeps a record of where you've been: the sites you visit, the files you download, the networks you join and the people you write to. This page lists every one of them: what it is, why it matters, how to clear it yourself without the app, and where to read more. The checks are done by a plain shell script inside the app, published under the MIT licence so anyone can read it and check that it changes nothing. The explanations here are the same ones the app shows next to each finding.

Disk protection

What it is

FileVault encrypts your whole startup disk, so its contents can't be read without your password.

Why it matters

With FileVault on, files deleted from an SSD can't be brought back with recovery tools. That means what matters is the data that still exists in the places below, not what was deleted before.

What to do

Turn it on in System Settings > Privacy & Security > FileVault. Encryption runs in the background while you use the Mac.

Where the app looks

  • The output of fdesetup status

Source: Apple Support, Protect data on your Mac with FileVault

Download history (LaunchServices quarantine log)

What it is

When an app downloads a file, macOS marks it so Gatekeeper can check it before it first opens. It also logs every download in a small database: the date, the app that downloaded it, and the web address it came from.

Why it matters

Clearing your browser history does not touch this log, so it can list downloads going back years. Entries made by AirDrop and Messages are files other people sent you.

Clear it by hand

Quit your browsers, then run this in Terminal to delete the entries. The database itself stays, and macOS keeps adding new downloads to it:

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'delete from LSQuarantineEvent'

Where downloaded files came from

Each downloaded file also keeps the address it came from on the file itself, which Get Info shows as Where from. It stays after the log and your browser history are cleared, so a file can still say which site it came from. To remove it by hand, run xattr -d com.apple.metadata:kMDItemWhereFroms followed by the file in Terminal. TrailSift removes only this address, never the quarantine mark macOS uses to check new downloads.

Where the app looks

  • ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
  • The com.apple.metadata:kMDItemWhereFroms attribute on files in your home folder, through Spotlight and in Downloads, Desktop and Documents

Source: The Eclectic Light Company, articles on the quarantine log

Safari

What it is

History.db records every page visit. The favicon cache keeps the small icons of sites you visited. The last session and recently closed tabs let Safari reopen your tabs, and the cache holds copies of images and pages you loaded.

Why it matters

The favicon cache and saved sessions can outlive a history clear, and together they show which sites were visited and when.

Clear it by hand

  • In Safari, choose History > Clear History, and pick "all history". This removes history, cookies and most cached data.
  • Safari > Settings > Privacy > Manage Website Data > Remove All clears what websites stored.
  • If the favicon cache or session files remain, quit Safari and move them to the Trash.

Where the app looks

  • ~/Library/Safari/History.db
  • ~/Library/Safari/Downloads.plist
  • ~/Library/Safari/Favicon Cache
  • ~/Library/Safari/LastSession.plist and RecentlyClosedTabs.plist
  • ~/Library/Cookies/HSTS.plist, the list of sites used over a secure connection, which clearing history leaves in place
  • ~/Library/Containers/com.apple.Safari/Data/Library/Caches

Safari's folder is protected by macOS, so the app needs Full Disk Access to read it.

Source: Apple Support, Clear your browsing history in Safari

Chrome-family browsers

What it is

Chrome, Chrome Beta, Brave, Edge, Arc, Vivaldi, Chromium and Opera share one design. Each profile has a History database (visits and downloads), Favicons (site icons) and Sessions (tabs to restore). The disk cache holds copies of images and pages you loaded.

Why it matters

Every profile keeps its own history, so a browser with several profiles has several records. The cache lives in a separate folder from the profile.

Clear it by hand

In the browser, press Shift-Command-Delete, or open Settings > Privacy and security > Delete browsing data. Choose "All time" and tick browsing history, download history and cached images and files. Repeat for each profile.

Where the app looks

  • ~/Library/Application Support/Google/Chrome/profile/History, Favicons and Sessions, and the matching folders for the other browsers
  • ~/Library/Caches/Google/Chrome, and the matching folders for the other browsers
  • TransportSecurity in each profile: every site used over a secure connection, stored as a hash of its name and kept after history is cleared

Source: Google Chrome Help, Delete browsing data in Chrome

Firefox

What it is

places.sqlite holds history, bookmarks and the downloads list. favicons.sqlite holds site icons, the session store keeps your open tabs, and the cache holds copies of pages and images.

Why it matters

Downloads and history live in the same database as your bookmarks, and each Firefox profile has its own copy.

Clear it by hand

In Firefox, press Shift-Command-Delete, or open Settings > Privacy & Security > History > Clear History. Choose "Everything" and select history, downloads and cache.

Where the app looks

  • ~/Library/Application Support/Firefox/Profiles/profile/places.sqlite
  • favicons.sqlite and sessionstore-backups in the same profile folder
  • ~/Library/Caches/Firefox
  • SiteSecurityServiceState.txt in each profile: every site used over a secure connection, by name, kept after history is cleared

Source: Mozilla Support, Delete browsing, search and download history on Firefox

Tor Browser

What it is

Tor Browser runs in permanent private browsing, so it normally saves no history. Its profile still keeps bookmarks, site icons and settings, including the last folder you saved a download to. Its Tor folder records network state, and the time that file was last written is roughly the last time Tor Browser was used.

Why it matters

Dragging the app to the Trash leaves the TorBrowser-Data folder behind. macOS also keeps its own records of the app: the download log, saved window state and the Dock.

Clear it by hand

  • To remove Tor Browser completely, delete the app and the TorBrowser-Data folder, as the Tor manual describes.
  • Delete its saved window state folder, and its installer from Downloads.
  • Its downloads stay in the macOS download log; see Download history.

Where the app looks

  • ~/Library/Application Support/TorBrowser-Data, including Tor/state and each profile's prefs.js
  • ~/Library/Caches/TorBrowser-Data
  • ~/Library/Saved Application State/org.torproject.torbrowser.savedState
  • The download log, Tor installers in ~/Downloads, and the Dock

Source: Tor Browser User Manual, Uninstalling

Other browsers

What it is

Zen, LibreWolf and Waterfox are built on Firefox and keep history, bookmarks and downloads in the same places.sqlite file. Safari Technology Preview keeps its own History.db, apart from Safari's. Orion and DuckDuckGo keep history, site icons and caches in their own data folders.

Why it matters

Clearing history in your main browser leaves every other browser's history as it was, and smaller browsers are easy to forget.

Each one installed gets a section of its own in the app:

  • Zen, LibreWolf and Waterfox: press Shift-Command-Delete, choose "Everything", and select history, downloads and cache.
  • Safari Technology Preview: choose History > Clear History.
  • Orion: clear history from the History menu.
  • DuckDuckGo: the Fire button clears history and site data at once.

Where the app looks

  • ~/Library/Application Support/zen/Profiles, librewolf/Profiles and Waterfox/Profiles
  • ~/Library/SafariTechnologyPreview/History.db
  • ~/Library/Application Support/Orion
  • ~/Library/Containers/com.duckduckgo.macos.browser

Sources: Mozilla Support, Profiles: where Firefox stores your data; Apple Developer, Safari Technology Preview; Kagi, Orion browser

Browser extensions

What it is

Extensions run inside your browser. The audit lists each one in Chrome-family browsers and Firefox, and says which can read and change every site you visit. It counts Safari's web extensions.

Why it matters

An extension that can read every site sees everything you browse, and some keep their own history or send it to their maker. Extensions installed once and forgotten keep that access.

Clear it by hand

  • Chrome-family browsers: open the Extensions page from the browser's menu and remove the ones you don't use.
  • Firefox: open Add-ons and Themes from the menu.
  • Safari: Safari > Settings > Extensions.

Where the app looks

  • Extensions in each Chrome-family profile, reading each extension's manifest.json
  • extensions.json in each Firefox profile
  • Safari web extensions registered with macOS

Source: Chrome Web Store Help, Install and manage extensions

Cookies and site data

What it is

Cookies keep you signed in and remember settings, and tracking cookies follow you from site to site. Sites also store data in your browser: local storage, databases and offline copies.

Why it matters

Clearing history leaves cookies and site data in place, and between them they name every site that set them.

Clear it by hand

  • Chrome-family browsers: Delete browsing data, and tick cookies and other site data. You'll be signed out of sites.
  • Firefox: Settings > Privacy & Security > Cookies and Site Data > Clear Data.
  • Safari: Safari > Settings > Privacy > Manage Website Data.

Where the app looks

  • Cookies, Local Storage, IndexedDB and Service Worker in each Chrome-family profile
  • cookies.sqlite and storage in each Firefox profile
  • ~/Library/Containers/com.apple.Safari/Data/Library/Cookies and WebKit/WebsiteData (need Full Disk Access)

Source: Google Chrome Help, Delete, allow and manage cookies

Thumbnails and previews

What it is

When Finder shows a file's icon preview, or you press Space to look at a file, macOS saves a small thumbnail in a hidden system cache.

Why it matters

Thumbnails stay after the original file is deleted, so this cache can hold small copies of pictures that are gone.

Clear it by hand

Run qlmanage -r cache in Terminal. It resets the thumbnail cache, and macOS rebuilds it as you browse.

Where the app looks

  • com.apple.QuickLook.thumbnailcache in your user cache folder, which getconf DARWIN_USER_CACHE_DIR prints

Source: The Eclectic Light Company, articles on the Quick Look thumbnail cache

Recent items and window state

What it is

macOS keeps lists of recently used documents, apps and servers: Apple menu > Recent Items, and File > Open Recent in each app. Finder separately remembers recent folders. Saved Application State is macOS Resume: when an app quits, its open windows are saved so they come back next time.

Why it matters

For browsers, saved window state can include window titles, which are page titles. Recent lists name files you opened, even after the files are gone.

Clear it by hand

  • Apple menu > Recent Items > Clear Menu.
  • In each app, File > Open Recent > Clear Menu.
  • In Finder, Go > Recent Folders > Clear Menu.
  • Quit an app with Option-Command-Q to close its windows without saving them, or turn on "Close windows when quitting an application" in System Settings > Desktop & Dock. Saved state for an app that's quit can be moved to the Trash.

Where the app looks

  • ~/Library/Application Support/com.apple.sharedfilelist
  • Finder's FXRecentFolders setting
  • ~/Library/Saved Application State

Sources: The Eclectic Light Company on recent items and on Saved Application State

Code editors and IDEs

What it is

Code editors keep their own lists of the folders and files you've opened, apart from macOS's Recent Items. VS Code, Cursor and other editors built on VS Code also keep the history of their built-in terminal, and a folder of saved state for every project ever opened: its open tabs, searches and extensions' data. JetBrains IDEs and Android Studio keep a list of recent projects.

Why it matters

Clearing Recent Items leaves these lists in place. The terminal history holds every command typed there, server addresses included, and an editor keeps a project's saved state long after the project itself is deleted.

Clear it by hand

  • In VS Code and Cursor, open the Command Palette and run File: Clear Recently Opened, then Terminal: Clear Previous Session History.
  • In a JetBrains IDE, remove projects from the Welcome screen's list.
  • In Sublime Text, choose File > Open Recent > Clear Items.

Where the app looks

  • ~/Library/Application Support/Code/User/globalStorage/state.vscdb, and the same for Cursor, VSCodium and Windsurf
  • ~/Library/Application Support/Code/User/workspaceStorage
  • ~/Library/Application Support/JetBrains/*/options/recentProjects.xml
  • ~/Library/Application Support/Sublime Text/Local/Session.sublime_session

Source: Visual Studio Code docs, the Command Palette

Keyboard and spelling

What it is

Words you teach the spell checker with Learn Spelling go in a list. The keyboard also keeps a model of the words you type, for its suggestions and autocorrection, including words you've stopped it correcting.

Why it matters

Learned words can include names, places and terms you'd rather not have suggested back to you, or seen by someone else.

Clear it by hand

  • Control-click a learned word in a document and choose Unlearn Spelling.
  • To start the keyboard's learning afresh, move the contents of ~/Library/Keyboard to the Trash, then log out and back in.

Where the app looks

  • ~/Library/Spelling/LocalDictionary
  • ~/Library/Keyboard

Source: Apple Support, Get typing suggestions and correct mistakes on Mac

Media players

What it is

VLC and IINA keep their own recently played lists, and IINA also caches thumbnails for its timeline previews.

Why it matters

These lists are separate from the macOS recent items, so clearing one doesn't clear the other.

Clear it by hand

  • In VLC, File > Open Recent > Clear Menu.
  • In IINA, the Utilities pane of its settings has buttons to clear its playback history and thumbnail cache.

Where the app looks

  • ~/Library/Preferences/org.videolan.vlc.plist
  • ~/Library/Application Support/com.colliderli.iina

Source: VideoLAN, VLC media player and IINA

Photos and messaging

What it is

Photos keeps deleted items in Recently Deleted for 30 days before removing them, and Hidden items stay in the library. Messages, WhatsApp, Telegram, Signal and Discord store photos and videos you send or receive as ordinary files, apart from the chats.

Why it matters

Deleting a conversation doesn't always remove its media, and a photo you deleted is still in the library for a month.

Clear it by hand

  • In Photos, open Recently Deleted under Utilities in the sidebar and choose Delete All. Review the Hidden album there too.
  • For Messages, System Settings > General > Storage lists large attachments you can delete. Deleting a conversation in Messages removes its attachments.
  • For the other apps, delete media from inside the app, through the chat or the app's storage settings. Deleting their files directly can confuse the app.

Where the app looks

  • The Photos library database, in ~/Pictures/Photos Library.photoslibrary
  • ~/Library/Messages/Attachments
  • ~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/Message/Media
  • Telegram's folder in ~/Library/Group Containers
  • ~/Library/Application Support/Signal/attachments.noindex
  • ~/Library/Application Support/discord/Cache

Source: Apple Support, Delete and recover photos and videos

Location in photos

What it is

A photo taken on a phone records where it was taken, often to within a few metres, in data stored inside the file. The audit counts the photos in Downloads, Desktop, Documents and Pictures that carry a location, outside the Photos library.

Why it matters

The location goes with the file when it's emailed, sent by AirDrop or uploaded to a site that keeps it. A photo taken at home, at a child's school or at work says where that is.

What TrailSift does

The Photo Locations page lists each photo with where it was taken, and makes copies without the location, ready to share. The originals stay as they are.

Do it by hand

  • To share from the Photos app without the location, click Options in the Share or Export window and turn off Location.
  • In Preview, choose Tools > Show Inspector, open the info tab, and click Remove Location Info under GPS. This changes the file itself.

Where the app looks

  • ~/Downloads, ~/Desktop, ~/Documents and ~/Pictures, through Spotlight

Source: Apple Support, View photos by location in Photos on Mac

Mail and documents

What it is

Opening an attachment in Mail saves a copy in a Mail Downloads folder. Preview and TextEdit keep autosaved copies of documents you haven't saved yet. Word, Excel and PowerPoint remember every file they've opened, so they can reopen it from the File menu. And macOS remembers everyone you've emailed or messaged, to suggest them again, including people who aren't in your contacts.

Why it matters

An attachment you saved or edited stays in Mail Downloads after the message is deleted. Office's list of files names documents you may have since deleted or moved.

Clear it by hand

  • Mail: delete the message and its unsaved attachments go with it. Quit Mail and move the contents of Mail Downloads to the Trash for the rest.
  • Preview and TextEdit: save or close the documents that are open; autosaved copies go when their document is saved or discarded.
  • Word, Excel and PowerPoint: in File > Open Recent, Control-click a file to remove it, or clear the unpinned files.
  • Remembered addresses: in Mail, start typing an address in a new message and click the arrow beside a suggestion to remove it from the list.

Where the app looks

  • ~/Library/Containers/com.apple.mail/Data/Library/Mail Downloads (needs Full Disk Access)
  • ~/Library/Containers/com.apple.Preview/Data/Library/Autosave Information, and the same for TextEdit
  • ~/Library/Containers/com.apple.corerecents.recentsd/Data/Library/Recents (needs Full Disk Access)
  • ~/Library/Containers/com.microsoft.Word/Data/Library/Preferences/com.microsoft.Word.securebookmarks.plist, and the same for Excel and PowerPoint

Sources: Apple Support, View, save or delete email attachments in Mail; Apple Support, View and restore past versions of documents; Microsoft Support, Customize the list of recently used files

Guide: How to remove the addresses Mail remembers on your Mac

Meeting and chat apps

What it is

Zoom saves meetings you record on this Mac in Documents/Zoom, and keeps its own data folder. Slack and Teams are built on a web browser, and their data folders hold a cache of the images, files and pages you've viewed in them, as well as sign-in data.

Why it matters

Recordings can hold whole conversations, and the caches keep copies of shared images and files after they're deleted from the chat.

Clear it by hand

  • Zoom: open Settings > Recording, click Open, and move recordings you don't need to the Trash.
  • Slack: choose Help > Troubleshooting > Clear Cache and Restart.
  • Teams: quit Teams, then move its data folders to the Trash, as Microsoft's steps describe. You'll sign in again; your chats stay on the service.

Where the app looks

  • ~/Library/Application Support/zoom.us/data and ~/Documents/Zoom
  • ~/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack, or ~/Library/Application Support/Slack
  • ~/Library/Containers/com.microsoft.teams2/Data/Library/Application Support/Microsoft/MSTeams, and classic Teams in ~/Library/Application Support/Microsoft/Teams

Sources: Zoom Support, Finding your computer and cloud recordings; Slack Help, Troubleshoot connection issues; Microsoft Learn, Clear the Teams client cache

Shell history, clipboard and printing

What it is

The shell saves every command typed in Terminal, and Terminal keeps a history for each window so it can restore them. Clipboard managers such as Maccy, Paste, Pastebot, Raycast and Alfred keep everything you copy. macOS's printing system keeps a list of finished print jobs, with the printer, size and time of each.

Why it matters

Commands can include file names, server addresses and, typed by mistake, passwords. A clipboard history can hold anything you've copied, passwords included.

Clear it by hand

  • Shell history: quit Terminal and any other terminal apps, then move ~/.zsh_history and ~/.zsh_sessions to the Trash.
  • Clipboard managers: clear the history from the app's menu or settings.
  • Print jobs: an administrator can run sudo cancel -a -x in Terminal. It also cancels anything still waiting to print.

Where the app looks

  • ~/.zsh_history, ~/.bash_history and ~/.zsh_sessions
  • Each clipboard manager's data folder
  • The list of finished jobs from lpstat -W completed

Sources: zsh manual, Options: History; Maccy; CUPS, cancel

Trash and Downloads

What it is

The Trash holds what you deleted until it's emptied. Downloads holds everything browsers and apps saved there.

Why it matters

Files in the Trash still exist, and the Downloads folder is often never cleared. The app counts the images and videos in it.

Clear it by hand

  • In Finder, choose Finder > Empty Trash.
  • Go through Downloads and delete what you no longer need.
  • System Settings > General > Storage can empty the Trash automatically after 30 days.

Where the app looks

  • ~/.Trash
  • ~/Downloads

Source: Apple Support, Optimize storage space on your Mac

Activity databases (Screen Time, Siri, app usage)

What it is

These databases power Screen Time, Siri Suggestions and other on-device intelligence. knowledgeC.db is the older one: which app was in front and for how long, when the Mac was locked and unlocked, what media was playing and, with Screen Time on, which websites were used. Biome is Apple's newer system for the same job. It stores activity as many small stream files, one stream per kind of event, and in macOS 26 Tahoe a new stream records the name of every menu command you choose.

Why it matters

They are some of the most detailed records on a Mac, and forensic examiners use them to rebuild a timeline of what was used and when. Some Biome streams sync to your other devices through iCloud.

What to do

These belong to macOS and aren't meant to be deleted by hand, and doing so can break Screen Time and Siri. You can limit what's collected: turn off Screen Time in System Settings > Screen Time, or turn off "Share across devices" there, and review the Siri settings in System Settings.

Where the app looks

  • ~/Library/Application Support/Knowledge/knowledgeC.db
  • ~/Library/Biome

Sources: Apple Support, Set up Screen Time, Bob Rudis on knowledgeC and Palo Alto Networks Unit 42 on Biome

Notification history

What it is

macOS keeps the notifications apps show, with their text, in a database of its own: message previews, codes sent by text, calendar invitations, reminders.

Why it matters

Notifications you've dismissed can stay in it for days, the text of a message included, after the message itself is deleted. Other clean-up tools leave it alone. It's protected, so TrailSift needs Full Disk Access to count it.

Clear it by hand

  • In System Settings > Notifications, set Show previews to When Unlocked or Never.
  • For apps whose notifications you'd rather weren't kept, choose the app there and turn off Show in Notification Centre.
  • Open Notification Centre by clicking the date in the menu bar and clear the notifications there.

TrailSift doesn't edit the database itself: macOS's notification service keeps it open, it also tracks notifications still on screen and snoozed, and its layout changes between macOS versions.

Where the app looks

  • ~/Library/Group Containers/group.com.apple.usernoted/db2/db

Source: Apple Support, Change Notifications settings on Mac

Startup items left by removed apps

What it is

Apps that run helpers at login or in the background install launch agents and daemons: small files that tell macOS what to start. Removing an app by dragging it to the Trash usually leaves them behind.

Why it matters

macOS keeps trying to start their missing programs at every login, and they record which apps you once used, parental controls and monitoring tools included. Those in /Library work for every account on the Mac.

Clear it by hand

Look in the folders below for files named after the app, and move them to the Trash; those in /Library ask for an administrator. Restart afterwards so macOS stops looking for them.

Where the app looks

  • ~/Library/LaunchAgents
  • /Library/LaunchAgents and /Library/LaunchDaemons
  • For each, whether the program it starts is still on the Mac

Source: Apple Support, Script management with launchd in Terminal on Mac

iPhone and iPad backups

What it is

Backing up an iPhone or iPad to this Mac in Finder copies the whole device here: messages, photos, notes and app data. An encrypted backup also holds saved passwords, website history, call history and health data, protected by a password; one that isn't encrypted has no password.

Why it matters

Backups of old devices stay until they're deleted. They can hold years of messages, and they're often the largest forgotten files on a Mac.

Clear it by hand

Connect any iPhone or iPad, select it in the Finder sidebar, click Manage Backups, select a backup and click Delete Backup.

Where the app looks

  • ~/Library/Application Support/MobileSync/Backup (needs Full Disk Access), reading each backup's device name, date and whether it's encrypted

Source: Apple Support, Locate and manage backups of your iPhone, iPad and iPod touch

Guide: How to find and delete old iPhone backups on your Mac

Remembered Wi-Fi networks

What it is

Your Mac remembers every Wi-Fi network it has joined so it can join again, and iCloud Keychain shares the list with your other devices.

Why it matters

The names of the networks are a record of where the Mac has been: homes, offices, hotels, cafés and airports. The report counts them; the names are listed only with top sites turned on.

Clear it by hand

Open System Settings > Wi-Fi, click Advanced, click the menu button next to a network and choose Remove From List.

Where the app looks

  • networksetup -listpreferredwirelessnetworks for the Wi-Fi interface

Source: Apple Support, Reset or remove Wi-Fi network settings on Mac

Guide: How to see and clear your Mac's Wi-Fi network history

Copies elsewhere

What it is

Deleting a file on this Mac doesn't delete copies elsewhere. With iCloud Desktop & Documents on, those two folders also live in iCloud and on your other devices, and Safari, Photos and Messages can sync too. Time Machine backups and local snapshots keep files as they were when the backup was made.

Why it matters

A file you deleted here can still be in a backup, in iCloud or on your iPhone.

What to do

  • Check what syncs in System Settings > your name > iCloud.
  • Safari: with Safari on in iCloud, clearing history on the Mac clears it on your iPhone and iPad too. Otherwise, on iPhone open Settings > Apps > Safari and tap Clear History and Website Data.
  • Screen Time: Share across devices puts each device's activity on the others. Turn it off in System Settings > Screen Time on the Mac, and in Settings > Screen Time on iPhone.
  • Messages and Photos: with Messages in iCloud or iCloud Photos on, deleting on one device deletes everywhere. Photos keeps deleted items in Recently Deleted for 30 days.
  • Chrome and Firefox: when signed in and syncing, deleting history in the browser removes it from the account and your other devices.
  • To remove an item from Time Machine, open its folder, enter Time Machine, select the item and choose Delete All Backups of it from the action menu.
  • Local snapshots are removed automatically after about 24 hours. TrailSift Pro can delete them straight away, after you confirm; macOS may ask for an administrator.

Where the app looks

  • Whether iCloud is signed in, and whether iCloud Desktop & Documents is on
  • tmutil destinationinfo, tmutil latestbackup and tmutil listlocalsnapshots /

Sources: Apple Support, iCloud Drive Desktop and Documents; Apple Support, Delete your Safari history on iPhone; Apple Support, Time Machine

Deep scan: images and videos outside the Photos library

What it is

An optional, slower check that finds image and video files outside the Photos library and lists the 20 busiest folders. Visible folders come from the Spotlight index. Library and hidden folders are checked by reading each file's first few bytes, so images saved without a file extension are found too.

Why it matters

Apps keep pictures in caches and hidden folders that you'd never browse to in Finder.

What to do

Open each folder from the report and look at what's there before deleting anything. Files inside an app's own folders are often its working data.

Where the app looks

  • Your home folder. iCloud, cloud-storage folders and Mail are skipped so nothing downloads.

TrailSift shows where traces are kept, not what they contain, and it can't see everything: some apps keep their own records, and copies can exist on other devices, in backups and with online services. It isn't a forensic tool, and a clean report is not a guarantee that no data remains.

Questions? Read the FAQ, ask in the Itch.studio Discord or see Support.