When you install software on macOS that requires an administrator password (like a complex audio driver or a system utility), it is usually delivered as a .pkg (Package) file. Unlike simple application bundles that you drag into the Applications folder, .pkg files contain hidden installation scripts and scatter files across deeply hidden system directories.
If you suspect an installer installed malicious files, or you are a system administrator who needs to completely uninstall a stubborn piece of software that lacks an uninstaller, you need to know exactly what the package did to your system.
To view the hidden contents and receipts of Apple Installer packages, you must use the pkgutil command in the macOS Terminal.
Step 1: Listing All Installed Packages
Every time a .pkg file is executed, macOS stores a receipt (a record of the installation) in a hidden database. You can query this database using pkgutil.
To view a massive list of every single package currently registered on your Mac, open the Terminal and type:
pkgutil --pkgsPress Return. The output will be incredibly long, containing core Apple system files and third-party software. To find a specific piece of software (e.g., Zoom), you should pipe the output into the grep search command:
pkgutil --pkgs | grep -i zoomThis will output the package’s exact identifier, which usually looks like a reverse domain name (e.g., us.zoom.xos).
Step 2: Inspecting Package Details
Once you have the exact identifier, you can query the database to find out exactly when the software was installed and where it was placed on the hard drive.
pkgutil --pkg-info us.zoom.xosThe terminal will output crucial metadata, including:
- version: The exact version number installed.
- volume: The hard drive partition it was installed to (usually
/). - location: The base directory where the files were dumped.
- install-time: A Unix timestamp of the exact second the installation occurred.
Step 3: Finding Every Single File Installed
The most powerful feature of pkgutil is its ability to list every single file the installer created, allowing you to track down hidden background daemons or kernel extensions.
pkgutil --files us.zoom.xosThis will print a comprehensive list of files and folders. Because the output can be overwhelming, you can redirect the list into a text file on your desktop for easier reading:
pkgutil --files us.zoom.xos > ~/Desktop/ZoomFiles.txtStep 4: Forgetting a Package (Advanced)
If you manually delete an application by dragging it to the trash, macOS still retains the package receipt. This can cause issues if you try to reinstall an older version of the software, as the installer might think a newer version is already present.
To force macOS to completely “forget” that the package was ever installed, use the --forget flag. Because this modifies the system database, it requires sudo:
sudo pkgutil --forget us.zoom.xosWarning: This command does not delete the actual files from your hard drive; it only deletes the receipt. You must still use the --files command to find and delete the software manually.