FileDial › Guides › Privacy and security
How to check a file's hidden data on a Mac
By Himanshu Ranjan · Updated 8 November 2026
Open the file in Preview and use the Inspector for image details, including where a photo was taken. Select any file in Finder and press Command-I for general details. For everything the system indexes, run mdls in Terminal. Then clean the file before sharing, since each method only shows what is there, it does not remove it.
Which method for which question
There is no single window that shows every kind of hidden data on a Mac, so pick the tool by what you want to know. Preview is best for photos and PDFs. Finder's Get Info window is quickest for basic details on any file. Terminal gives the most complete list of what Spotlight has recorded, and also lets you see the download history and quarantine flags that macOS attaches to files.
All of this works on macOS 14 and later and needs no extra software.
Preview: the Inspector for photos and PDFs
Apple's Preview guide describes an Inspector window with several panes: general information, more info (image details in different formats, including where a photo was taken), keywords, encryption (for password-protected PDFs), crop and annotations. The annotations pane matters for PDFs, since comments and markup can sit in a file you thought was clean.
- Open the photo or PDF in Preview.
- Click the Info button in the toolbar, or look under the Tools menu, to show the Inspector.
- Switch between the panes. On photos, use the more info pane to read capture details and location.
- Close the window without saving. Looking does not change the file.
Finder: Get Info
Select a file in Finder and press Command-I, the shortcut Apple lists for Show Get Info, or Control-click it and choose Get Info. You will see kind, size, created and modified dates, and a More Info section for some types, which can include image dimensions and other details. It is a quick way to check dates and, for downloads, to see where a file came from. It is not a full metadata view.
Terminal: mdls and xattr
Terminal is the most complete option and is safe for reading. mdls prints the metadata attributes Spotlight holds for a file. xattr -l prints extended attributes, which is where the quarantine flag and download origin live. Neither command changes anything.
Run mdls followed by a space, then drag the file into the Terminal window to fill in the path. Look for author, creation date, content creator, and for photos, latitude and longitude fields. For downloaded files, mdls -name kMDItemWhereFroms shows where the file came from, when that was recorded.
- Open Terminal from Applications › Utilities.
- Type mdls, a space, then drag the file into the window and press Return.
- For extended attributes, type xattr -l, a space, drag the file in and press Return.
- Scroll through the output for names, dates, apps and coordinates.
Clean the file, then check again
Once you know what a file reveals, FileDial can write a clean copy. Use Privacy › Remove all metadata or Privacy › Remove location on photos, Sign & Lock › Remove metadata on PDFs, and Privacy › Remove metadata on documents, spreadsheets and slides. Privacy › Remove extended attributes & quarantine writes a clean copy without quarantine flags, Finder tags, comments or download source.
For PDFs, Sign & Lock › Inspect PDF writes a short text report you can read before sending. Run your chosen check again on the new copy. The result lands beside the original, so you can compare both.
What each method will and will not show
No single view is complete, and knowing the gaps stops false confidence. Preview's Inspector is good at photo details and PDF annotations, but it reflects what Preview can read, so an unusual field may not appear. Get Info is fast but shallow, and for most file types it shows dates, kind and size rather than author or software fields. mdls reads what Spotlight has indexed, which is broad but can lag behind a file you just changed, and some fields appear only for certain file types.
A practical routine is two checks. First, look in Preview or Get Info for the obvious items: location, dates, author. Second, if the file matters, run mdls and scan for names, company fields and coordinates. For PDFs, add Sign & Lock › Inspect PDF, which writes a short report, and look for comments and annotations in Preview's annotations pane.
Common traps: checking the original instead of the cleaned copy, forgetting that Spotlight may need a moment to reindex a new file, and assuming a screenshot or a re-saved file is automatically clean. After any clean-up, run the same check you used before and compare, so you know the tool did what you expected.
If you handle many files, repeating this by hand is slow. FileDial's clean-up tools run on a whole selection, and the result card shows what changed and the size before and after. That does not replace a final spot check of one or two outputs, which is cheap insurance before a file goes to a client, a court or a public site.
Questions
Does Preview show GPS location for every photo?
Only when location data is stored in the photo. Pictures taken with location services off, or already stripped by an app or a clean-up tool, show none. Apple's guide says the more info pane includes where a photo was taken when that information exists, so an empty pane is a real answer, not a missing feature.
Will opening a file in Preview change its metadata?
Viewing the Inspector does not change the file. Saving or exporting from Preview can rewrite parts of it, so close the window without saving if you only wanted to look, and work on a duplicate when the file is important. Command-D duplicates the selected file in Finder.
Is the Terminal method safe for beginners?
mdls and xattr -l only read information, so they are safe to try and change nothing. Avoid commands that include a write or delete option unless you understand them. If Terminal feels like too much, Preview's Inspector and Finder's Get Info cover most everyday checks without any commands.
Why does a screenshot show a different author than the original?
A screenshot is a new file created by macOS, so it has its own details and does not inherit the original photo's metadata. That is why screenshots are sometimes used as a crude way to strip location, though the resolution drops and a proper clean-up tool keeps the pixels untouched.