# Quick Look

Quick Look is a quick preview feature developed by Apple Inc. which was introduced in its operating system Mac OS X 10.5 Leopard. The feature was announced at the Worldwide Developers Conference on Jun. 11, 2007.
While macOS's Finder has always had smaller previews in Get Info windows or column view, Quick Look allows users to look at the contents of a file at full or near-full size in the Finder, depending on the size of the document relative to the screen resolution. It can preview files such as PDFs, HTML, QuickTime readable media, plain text and RTF text documents, iWork (Keynote, Pages, and Numbers) documents, ODF documents, Microsoft Office (Word, Excel, and PowerPoint) files (including OOXML), and RAW camera images. In addition, Quick Look supports viewing multiple files simultaneously by selecting them and using a split view to compare contents side by side, a feature particularly useful for examining differences between documents or images.
Quick Look can also be opened in full screen and launched from the command line. Additionally, multi-page documents like PowerPoint slide shows can be navigated using the slide previews at the side of the preview window. Starting with macOS Mojave, Quick Look has been enhanced with markup tools, allowing users to annotate PDFs and images directly within the Quick Look interface without opening a separate application.
Quick Look technology is implemented throughout the Apple suite of software starting with Mac OS X 10.5, including iChat Theater, Time Machine, and Finder's Cover Flow. The integration with Time Machine allows users to preview versions of files within the backup system, making it easier to find specific versions before restoring them.
Quick Look APIs are available to developers via the Quick Look framework on iOS and as part of the Quartz framework on the Mac. Developers can customize Quick Look to support additional file types in their applications, expanding the utility of this feature across various software ecosystems.

## Supported file types by default

Since its debut, Quick Look has included a number of generators for common file types.
| Format | Version introduced | Notes |
| AAC | 10.5 | Cover art in icon view and can play back audio in full preview. |
| Adobe Photoshop | 10.5 | |
| AIFF | 10.5 | |
| Apple Icon Image format | 10.5 | |
| AVI | 10.5 | |
| BMP | 10.5 | |
| COLLADA's DAE | 10.6 | |
| Cinema 4D's .c4d | | Displays the 2D Preview Image embedded in the file. |
| GIF | 10.5 | Did not animate animated GIFS without additional plugins until OS X 10.7. |
| HTML | 10.5 | Does not load remote resources or execute scripts. |
| iChat transcripts | 10.5 | |
| JPEG | 10.5 | |
| JPEG 2000 | 10.5 | |
| Microsoft Excel | 10.5 | |
| Microsoft PowerPoint | 10.5 | |
| Microsoft Word | 10.5 | |
| MIDI | 10.5 | MIDI files support has been dropped in OS X 10.8. |
| MP3 | 10.5 | Cover art in icon view and can play back audio in full preview. |
| MPEG4 | 10.5 | |
| MPO | | |
| PDF | 10.5 | |
| PictureClipping | 10.6 | |
| PICT | 10.5 | |
| PNG | 10.5 | |
| QuickTime movies | 10.5 | Additional stream formats require the appropriate QuickTime extension to be installed. |
| RTF | 10.5 | |
| SVG | 10.6 | |
| TEXT | 10.5 | |
| TextClipping | 10.6 | |
| TIFF | 10.5 | |
| WAV | 10.5 | |

## Plug-ins

Plug-ins can be added to Quick Look to allow previewing the content of other file formats. Plug-ins can also be used to add additional functionality to Quick Look such as syntax highlighting for source code files.
To add a plug-in to Quick Look it needs to be placed in the folder /Library/QuickLook/. To activate that plug-in, either the computer needs to be restarted or Quick Look needs to be reset with the command

## Usage

There are multiple ways to invoke Quick Look.
Keyboard shortcuts:
* ⌘ Cmd-Y
* space
* ⌥ Opt-space (open in full screen)
* ⌥ Opt hold to zoom an image to actual size (Quick Look must already be open)
Command line:
Menu:
* File — Quick Look file name;
* Context menu (right-click or Control-mouse click), then Quick Look file name.

## Caching and Forensics

Quick Look can be exploited when conducting a forensic examination of a computer's contents. A thumbnail cache is created for each user in a random subfolder of /var/folders called com.apple.QuickLook.thumbnailcache. The cache contains two files;
* index.sqlite which is a SQLite database containing two tables - files and thumbnails.
       files contains the name, path, file-identifier, and volume-identifier of each file in the database.
       thumbnails contains metadata about each thumbnail, including the file linked-to in the files table and the offset of its data contained in thumbnails.data.
* thumbnails.data contains the raw bitmaps of the cached thumbnails.
Quick Look thumbnails are stored for documents on internal disks and also for documents located on removable disks, including those that have been encrypted and can pose a significant security hole. A document may well have a number of thumbnails, each having different dimensions that can range from very large to very small.
The cache can be reset by invoking the qlmanage -r cache command via a Terminal window.