mdutil
mdutil manages the Spotlight metadata indexes stored on each volume. Spotlight indexes are used by mdfind, the Finder, and incident responders to locate files, and the on-disk Spotlight store can retain metadata useful during forensic investigations. An attacker with root can use mdutil to stop indexing so staged files do not appear in Spotlight searches, or erase and remove existing indexes to destroy forensic evidence. Any user can query indexing status.
- Path
- /usr/bin/mdutil
- Author
- Brendan Chamberlain (@infosecB)
- Created
- 2026-11-07
Example Use Cases 4
Check Spotlight indexing status of all volumes #
Print the indexing status of every mounted volume. Volumes with indexing disabled are less likely to have staged files discovered through Spotlight searches. This command does not require root.
mdutil -saDisable Spotlight indexing to hide staged files #
Turn off Spotlight indexing for the data volume or for all volumes. Files written afterwards are not added to the index, so they do not appear in mdfind or Finder search results.
sudo mdutil -i off /System/Volumes/Data
sudo mdutil -a -i offErase the Spotlight index to remove forensic artifacts #
Erase and rebuild the Spotlight index, discarding metadata about files that were previously indexed, including files that have since been deleted.
sudo mdutil -E /System/Volumes/DataRemove the Spotlight index from an external volume #
Delete the Spotlight index directory from a volume such as a USB drive used to stage or exfiltrate data, then disable indexing so it is not rebuilt.
sudo mdutil -X /Volumes/USB
sudo mdutil -i off /Volumes/USBDetections
- Command-line detection: mdutil with -i off, -d, -E, or -X arguments
- Process execution detection: mdutil executed by a script interpreter, an unsigned process, or as part of a sequence with other anti-forensics commands such as log erase or tmutil deletelocalsnapshots