# mdutil

> Manage Spotlight metadata indexing on local and external volumes.

mdutil manages the Spotlight metadata indexes stored on each volume. Spotlight indexes are used by mdfind, the Finder, and incident responders to locate files, and the on-disk Spotlight store can retain metadata useful during forensic investigations. An attacker with root can use mdutil to stop indexing so staged files do not appear in Spotlight searches, or erase and remove existing indexes to destroy forensic evidence. Any user can query indexing status.

- Page: https://loobins.io/binaries/mdutil/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2026-11-07
- Tactics: Stealth, Discovery

## Paths

- `/usr/bin/mdutil`

## Example Use Cases

### Check Spotlight indexing status of all volumes

Print the indexing status of every mounted volume. Volumes with indexing disabled are less likely to have staged files discovered through Spotlight searches. This command does not require root.

```bash
mdutil -sa
```

- Tactics: Discovery
- Tags: oneliner, bash, spotlight

### Disable Spotlight indexing to hide staged files

Turn off Spotlight indexing for the data volume or for all volumes. Files written afterwards are not added to the index, so they do not appear in mdfind or Finder search results.

```bash
sudo mdutil -i off /System/Volumes/Data
sudo mdutil -a -i off
```

- Tactics: Stealth
- Tags: oneliner, bash, spotlight

### Erase the Spotlight index to remove forensic artifacts

Erase and rebuild the Spotlight index, discarding metadata about files that were previously indexed, including files that have since been deleted.

```bash
sudo mdutil -E /System/Volumes/Data
```

- Tactics: Stealth
- Tags: oneliner, bash, spotlight, anti-forensics

### Remove the Spotlight index from an external volume

Delete the Spotlight index directory from a volume such as a USB drive used to stage or exfiltrate data, then disable indexing so it is not rebuilt.

```bash
sudo mdutil -X /Volumes/USB
sudo mdutil -i off /Volumes/USB
```

- Tactics: Stealth
- Tags: bash, spotlight, anti-forensics, disk

## Detections

- Command-line detection: mdutil with -i off, -d, -E, or -X arguments
- Process execution detection: mdutil executed by a script interpreter, an unsigned process, or as part of a sequence with other anti-forensics commands such as log erase or tmutil deletelocalsnapshots

## Resources

- [mdutil man page - SS64](https://ss64.com/mac/mdutil.html)
- [Indicator Removal - MITRE ATT&CK](https://attack.mitre.org/techniques/T1070/)