Find out where files were downloaded from with Python and xattr

Ever forget where you downloaded a file from? On OS X you can use HFS extended attributes to figure it out. Linux and Windows also support extended attributes but I don't know much about their implementations.

To find out where we downloaded a particular file from we can execute this command:
% xattr -p com.apple.metadata:kMDItemWhereFroms

The results will look like:
nya:~/Downloads % xattr -p com.apple.metadata:kMDItemWhereFroms CentOS-5.8-i386-netinstall.iso
62 70 6C 69 73 74 30 30 A2 01 02 5F 10 4C 68 74
74 70 3A 2F 2F 79 75 6D 2E 73 69 6E 67 6C 65 68
6F 70 2E 63 6F 6D 2F 43 65 6E 74 4F 53 2F 35 2E
38 2F 69 73 6F 73 2F 69 33 38 36 2F 43 65 6E 74
4F 53 2D 35 2E 38 2D 69 33 38 36 2D 6E 65 74 69
6E 73 74 61 6C 6C 2E 69 73 6F 5F 10 2E 68 74 74
70 3A 2F 2F 79 75 6D 2E 73 69 6E 67 6C 65 68 6F
70 2E 63 6F 6D 2F 43 65 6E 74 4F 53 2F 35 2E 38
2F 69 73 6F 73 2F 69 33 38 36 2F 08 0B 5A 00 00
00 00 00 00 01 01 00 00 00 00 00 00 00 03 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 8B

Attribute values are usually returned by the -p flag as strings; however, when the value contains nulls the information will be returned in hex instead. This info isn't terribly useful so let's hop over into the Python REPL and take a look.

>>> import xattr
>>> xattr.getxattr('CentOS-5.8-i386-netinstall.iso', 'com.apple.metadata:kMDItemWhereFroms')
'bplist00\xa2\x01\x02_\x10Lhttp://yum.singlehop.com/CentOS/5.8/isos/i386/CentOS-5.8-i386-netinstall.iso_\x10.http://yum.singlehop.com/CentOS/5.8/isos/i386/\x08\x0bZ\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8b'