SAFARI
The SAFARI plugin gets Browser History, Topsites (frequently visited sites), Bookmarks, Downloaded file listing, Last session info, Extension and Reading List data from several plist and database files listed at the paths below. It also gets some preferences and last used settings such as recent searches and application launch times.
| macOS Version | Path |
|---|---|
| Lion, Mtn Lion, Mavericks, | /Users/{USER}/Library/Safari/* |
| Yosemite, ElCap, Sierra, High Sierra | /Users/{USER}/Library/Preferences/com.apple.safari.plist |
This plugin supports standalone mode.
$ python mac-apt.py -x -o ~/Case_Output E01 ~/Acquisition.E01 SAFARI
| Field Name | Notes |
|---|---|
| Type |
HISTORY : Browser History GENERAL : Search results from /Users/{USER}/Library/Preferences folder TOPSITE : Webpages that appear in "Top Site" section when opening a new tab EXTENSION : Extensions installed to Safari DOWNLOAD : Downloaded files from Safari LASTSESSION : Last Session info |
| Name_or_Title | The title of the webpage (on the tab) |
| URL | The URL of the webpage |
| Date | Date/Time accessing the webpage or otherwise noted under Other_Info for GENERAL type |
| Other_Info | Other available information for GENERAL, DOWNLOAD, and EXTENSION types |
| User | User's Profile that accessed the webpage |
| Source | Source location where the file was retrieved |