Apple Spotlight Store
| Format | Apple Spotlight Store |
|---|---|
| Short name | Spotlight |
| Category | database |
| Platforms | macOS, iOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Apple Spotlight metadata indexes used by macOS and iOS. On macOS, stores are typically found below /.Spotlight-V100/Store-V2/<UUID>/ and can contain store.db and .store.db files; on iOS, CoreSpotlight indexes are found below .../Library/Spotlight/CoreSpotlight/ (index.spotlightV2). Other Spotlight/CoreSpotlight indexes can exist in user and application-specific locations. The store contains metadata records associated with indexed file-system objects, including file names, paths or path-related information, content types, creation and modification dates, last-used dates, authors, download/source information, URLs and other metadata; depending on the item and index, textual content or searchable content metadata may also be present. Spotlight data is therefore valuable for reconstructing the existence and metadata of files that are no longer present on the live file system, although the presence of an index record does not by itself prove that the corresponding file still existed at the time of acquisition or establish how the file was accessed. Spotlight stores are proprietary databases and their exact contents vary with macOS/iOS versions and the type of index.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 38 74 73 64 | 8tsd | Signature '8tsd' at the beginning of a Spotlight store database |
Known extensions
None recorded
References
- Apple Spotlight store file formats (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/Apple%20Spotlight%20store%20database%20file%20format.asciidoc
- spotlight_parser (Yogesh Khatri) https://github.com/ydkhatri/spotlight_parser
Cite this entry
Crush Format Reference, “Apple Spotlight Store”. https://kalink0.github.io/crush-forensics/formats/spotlight/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction