We recently added support for analysing Safari history from macOS in Browser History Examiner (BHE).

There are currently two options for loading macOS browser history into BHE:
  1. Load from a forensic image
    2. BHE does not directly support the parsing of forensic image files therefore you will need to mount the forensic image first. For mounting macOS APFS images on Windows you can use Mount Image Pro.
  2. Copy the history files over and manually load into BHE

BHE currently supports the following Safari artifacts:
  • Bookmarks
  • Cached Files
  • Cookies
  • Downloads
  • Favicons
  • Searches
  • Session Data
  • Site Settings
  • Thumbnails
  • Website Visits

Most Safari history artifacts are stored as binary plist files or SQLite databases.

Bookmarks
Location: /Users/<username>/Library/Safari/Bookmarks.plist
Format: Binary plist

Browser Settings
Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist
Format: Binary plist

Cache
Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Caches/com.apple.Safari
Format: Custom binary

Cookies
Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies
Format: Custom binary

Downloads
Location: /Users/<username>/Library/Safari/Downloads.plist
Format: Binary plist

Favicons
Location: /Users/<username>/Library/Safari/FaviconCache/favicons.db
Format: SQLite (the favicons themselves are stored within the 'favicons' subfolder)

Searches
Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist
Format: Binary plist

Session Data
Location:
/Users/<username>/Library/Safari/LastSession.plist
/Users/<username>/Library/Safari/RecentlyClosedTabs.plist
Format: Binary plist

Site Settings
Location:
/Users/<username>/Library/Safari/PerSitePreferences.db
/Users/<username>/Library/Safari/PerSiteZoomPreferences.db
/Users/<username>/Library/Safari/UserMediaPermissions.db
Format: SQLite

Thumbnails
Location: /Users/<username>/Containers/com.apple.Safari/Data/Library/Caches/com.apple.Safari/TabSnapshots/metadata.db
Format: SQLite (the thumbnails themselves are stored as individual files in the same folder)

Website Visits
Location: /Users/<username>/Library/Safari/History.db
Format: SQLite

Plist Viewer

BHE also includes a built-in plist viewer for manually examining both XML and binary plist files.



Chromium 'Simple Cache'

We have also extended support for analysing macOS browser history by adding support for the 'Simple Cache' format used by Chromium browsers such as Chrome and Edge on macOS.