By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to Wojciech Reguła and Patrick Wardle, two macOS security experts. The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale. But in a recent macOS version, Apple has added a new feature to Finder called QuickLook. This feature allows users to hold down the Space key while having a file selected and view an image-like preview of the document's content. Apple devs created this feature to allow users to preview files with similar names and determine which one they want to open. Follow along at OUR FORUM.