Quick category on NSFileManager to read in and return the kMDItemWhereFroms extended attribute of a file on disk.

NSFileManager+WhereFromXAttr.h

#import <Foundation/Foundation.h>

@interface NSFileManager (WhereFromXAttr)

/// Returns the value of a given file's com.apple.metadata:kMDItemWhereFroms extended attribute.
- (NSArray *)valueForWhereFromExtendedAttributeOfFile:(NSString *)path;

@end

NSFileManager+WhereFromXAttr.m

#import "NSFileManager+WhereFromXAttr.h"
#import <sys/xattr.h>

@implementation NSFileManager (WhereFromXAttr)

- (NSArray *)valueForWhereFromExtendedAttributeOfFile:(NSString *)path {
	/*
	 We're going to look at the file's "com.apple.metadata:kMDItemWhereFroms" extended
	 attribute to see where it came from. To do that, we:
	 
	 1. Read in the size of the file's "com.apple.metadata:kMDItemWhereFroms" extended
	 attribute (in bytes) by calling getxattr() without a buffer to store the value in.
	 If -1, there's no value for the attribute (so we return nil).
	 
	 2. Allocate a buffer to store the attribute's value in.
	 
	 3. Call xattr() with the buffer to get the extended attribute value.
	 
	 Once we've got the attribute value as raw bytes, we turn it into NSData.
	 */
	const char *attributeName = [@"com.apple.metadata:kMDItemWhereFroms" UTF8String];
	const char *filePath = [path fileSystemRepresentation];
	
	// get size we'll need for the buffer
	ssize_t bufferLength = getxattr(filePath, attributeName, NULL, 0, 0, 0);
	
	if (bufferLength == -1) {
		return nil;
	}
	
	// make a buffer of that size
	char *buffer = malloc(bufferLength);
	// get the extended attribute value
	getxattr(filePath, attributeName, buffer, 255, 0, 0);
	// turn the bytes into NSData
	NSData *attributeAsData = [NSData dataWithBytes:buffer length:bufferLength];
	// release buffer
	free(buffer);
	
	/*
	 The value of the "kMDItemWhereFroms" attribute is a plist representing the list of URLs a
	 file was downloaded from (a list because there may have been redirects to get from the link
	 the user clicked on in their browser to the URL the browser downloads the file from).
	 
	 Because the value is a plist, we use NSPropertyListSerialization to turn the data into an array.
	 */
	NSArray *sources = [NSPropertyListSerialization propertyListWithData:attributeAsData options:NSPropertyListMutableContainers format:nil error:nil];
	return sources;
}

@end