The Illusion of App Deletion
Unlike Windows, which relies on a centralized Registry and a standardized “Add/Remove Programs” control panel, macOS applications appear deceptively simple. Most consumer applications are distributed as a single .app bundle. To uninstall them, a user simply drags the icon from the Applications folder into the Trash.
However, enterprise-grade software—like antivirus agents (CrowdStrike), VPN clients (Cisco AnyConnect), or massive creative suites (Adobe CC)—are rarely distributed as simple drag-and-drop bundles. They are distributed as .pkg Installer Packages.
When you run a .pkg file, it does not just drop an icon into the Applications folder. It uses root privileges to scatter hidden frameworks into /Library/Frameworks, inject launch daemons into /Library/LaunchDaemons, and write complex scripts across the hard drive. If you drag the main app icon to the trash, those hidden files remain, consuming disk space and potentially causing devastating conflicts during future software upgrades.
To mathematically track, interrogate, and completely obliterate software installed via .pkg, Mac administrators rely on the pkgutil (Package Utility) command. pkgutil peers directly into the hidden macOS Installer Receipt database, exposing exactly where every single file was placed during the initial installation.
Step 1: Understanding Installer Receipts
Every time the macOS Installer application successfully executes a .pkg file, it writes a cryptographic “Receipt” to a hidden SQLite database located deep within /var/db/receipts/.
This receipt contains the unique Bundle Identifier of the package (e.g., com.cisco.anyconnect.vpn), the version number, and a complete Bill of Materials (BOM)—a mathematical manifest listing the exact file path of every single file the installer wrote to the hard drive.
To view every single package receipt currently registered on the Mac, open the Terminal and run:
pkgutil --pkgsThis will dump hundreds of lines of identifiers. You will see Apple’s native system packages (like com.apple.pkg.Safari) mixed with third-party software.
Step 2: Interrogating a Specific Package
Suppose you are tasked with completely removing an older version of Cisco AnyConnect, and you need to know exactly what the original installer did.
First, filter the package list to find the exact identifier:
pkgutil --pkgs | grep -i ciscoAssume the output reveals the identifier is com.cisco.pkg.anyconnect.vpn.
Now, query the database for the basic metadata of that specific package:
pkgutil --pkg-info com.cisco.pkg.anyconnect.vpnThe output will show the installation date, the version number, and the Install Location (usually /, meaning the root of the drive).
Step 3: Extracting the Bill of Materials (BOM)
To execute a flawless, surgical uninstallation, you need to see the exact files the installer scattered across the hard drive.
Use the --files flag to dump the Bill of Materials to the terminal:
pkgutil --files com.cisco.pkg.anyconnect.vpnThe output is incredibly revealing. You will not just see Applications/Cisco AnyConnect Secure Mobility Client.app. You will see hidden daemons in opt/cisco/anyconnect/bin/ and background agents in Library/LaunchAgents/com.cisco.anyconnect.gui.plist.
By saving this output to a text file (pkgutil --files com.cisco.pkg.anyconnect.vpn > ~/Desktop/cisco_files.txt), a systems administrator can write a highly precise bash script that loops through every single file in that list and runs the rm command, guaranteeing a 100% clean uninstallation.
Step 4: Purging the Receipt Database (The Forget Command)
If you manually delete the application and its hidden files, you have removed the software from the hard drive, but the receipt still exists in the macOS database.
This causes massive deployment failures. If you try to push a new version of the software via an MDM (like Jamf Pro), the MDM agent queries the receipt database, sees that com.cisco.pkg.anyconnect.vpn is already installed, and aborts the deployment, falsely assuming the machine is already up to date.
You must forcefully delete the receipt from the database to clear the path for future installations. You use the --forget flag (which requires root privileges):
sudo pkgutil --forget com.cisco.pkg.anyconnect.vpnThe terminal will respond: Forgot package 'com.cisco.pkg.anyconnect.vpn' on '/'. The MDM will now see the Mac as a clean slate and allow the new .pkg to deploy successfully.
Step 5: Expanding Payloads without Installing
Sometimes you don’t want to install a .pkg file; you just want to see what is inside it. Perhaps a vendor sent you a script, and you want to audit the post-install bash scripts before granting it root access to your machine.
You can use pkgutil to rip open a flat package file without executing the installer.
pkgutil --expand ~/Downloads/VendorTool.pkg ~/Desktop/Expanded_Package/This will decompress the .pkg file into a standard folder on your desktop. Inside, you will find the Payload file (the actual compressed application), the Bom file, and a Scripts directory. You can open the Scripts directory and read the raw preinstall and postinstall bash scripts to mathematically verify exactly what the vendor is attempting to do to your operating system.
Conclusion
Dragging an application icon to the Trash is a consumer illusion that leaves enterprise Mac environments littered with orphaned daemons, corrupted caches, and phantom receipt files. By mastering the pkgutil command, macOS engineers gain X-ray vision into the Apple Installer subsystem. The ability to extract complete Bills of Materials for surgical uninstallation, forcefully purge corrupted receipts to unblock MDM deployments, and audit vendor payloads before execution is critical for maintaining a pristine, secure fleet of enterprise Macs.