We recently added support for analysing Safari history from macOS in Browser History Examiner (BHE).

There are currently two options for loading macOS browser history into BHE:
  1. Load from a forensic image
  2. BHE does not directly support the parsing of forensic image files therefore you will need to mount the forensic image first. For mounting macOS APFS images on Windows you can use Mount Image Pro.
  3. Copy the history files over and manually load into BHE

BHE currently supports the following Safari artifacts:
  • Bookmarks
  • Cached Files
  • Cookies
  • Downloads
  • Favicons
  • Searches
  • Session Data
  • Site Settings
  • Thumbnails
  • Website Visits

Most Safari history artifacts are stored as binary plist files or SQLite databases.

Location: /Users/<username>/Library/Safari/Bookmarks.plist
Format: Binary plist

Browser Settings
Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist
Format: Binary plist

Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Caches/com.apple.Safari
Format: Custom binary

Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies
Format: Custom binary

Location: /Users/<username>/Library/Safari/Downloads.plist
Format: Binary plist

Location: /Users/<username>/Library/Safari/FaviconCache/favicons.db
Format: SQLite (the favicons themselves are stored within the 'favicons' subfolder)

Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist
Format: Binary plist

Session Data
Format: Binary plist

Site Settings
Format: SQLite

Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Caches/com.apple.Safari/TabSnapshots/metadata.db
Format: SQLite (the thumbnails themselves are stored as individual files in the same folder)

Website Visits
Location: /Users/<username>/Library/Safari/History.db
Format: SQLite

Plist Viewer

BHE also includes a built-in plist viewer for manually examining both XML and binary plist files.

Chromium 'Simple Cache'

We have also extended support for analysing macOS browser history by adding support for the 'Simple Cache' format used by Chromium browsers such as Chrome and Edge on macOS.