The Hidden Data Inside Your Files
When you look at a photograph in the macOS Finder, you only see the image itself. However, that file contains a massive amount of hidden data, known as metadata. A single photograph from your iPhone contains the exact GPS coordinates of where it was taken, the altitude, the type of lens used, the aperture, and whether the flash fired.
Similarly, a PDF downloaded from the internet contains metadata revealing the name of the software used to generate it, the original author, and the exact date it was created. While you can see a tiny fraction of this metadata by right-clicking a file and selecting “Get Info,” the macOS graphical interface hides 90% of the true underlying data from the user.
To see every single piece of metadata attached to a file, you must use the mdls (Metadata List) command. This taps directly into Spotlight’s core database to reveal the raw information Apple uses to index your hard drive.
Step 1: Open the Terminal
Because you are interacting with Spotlight’s raw indexing engine, you must use the Terminal.
- Press Command + Space to open Spotlight Search.
- Type
Terminaland press Enter.
Step 2: Viewing All Metadata for a File
To use the command, simply type mdls followed by a space, and then the path to the file you want to investigate. The easiest way to get the exact file path is to drag and drop the file from the Finder directly into your Terminal window.
mdls /Users/john/Desktop/financial_report.pdf
The terminal will instantly output a long list of attributes. Every line represents a different piece of metadata, formatted as a key-value pair.
For example, you might see:
kMDItemAuthors = ( "John Smith" )kMDItemCreator = "Microsoft Word"kMDItemWhereFroms = ( "https://example.com/download" )
This instantly proves that the PDF was originally typed in Microsoft Word by John Smith, and it was downloaded from a specific website on the internet (the WhereFroms attribute is how macOS knows to warn you when you open an application downloaded from a web browser).
Step 3: Searching for a Specific Attribute
If you run mdls on a complex video file, it might output over 100 lines of data, making it very difficult to read. If you are a video editor and you only care about the exact pixel resolution of the file, you do not need to scroll through the entire list.
You can use the -name flag to ask Spotlight for one specific piece of metadata.
mdls -name kMDItemPixelHeight -name kMDItemPixelWidth /Users/john/Desktop/video.mp4
This command ignores everything else and simply outputs the exact height and width of the video file in raw pixels.
Step 4: Using Metadata for Security
The mdls command is an incredibly powerful tool for digital forensics and basic security.
If someone sends you a suspicious Word document via email claiming they wrote it yesterday, you can download the file (without opening it in Word) and run the mdls command on it.
By checking the kMDItemContentCreationDate and the kMDItemAuthors attributes, you can easily verify if the document was actually created yesterday, or if it is a template that was created five years ago by someone entirely different. This raw metadata cannot easily be forged without advanced tools, making it an excellent first step for investigating suspicious files on your Mac.