← All artifacts

Safari Browser

Complete Safari browser artifacts including browsing history, downloads, bookmarks, cookies, extensions, and session data.

Status
available
CLI plugin
browser.safari
Categories
browser, user

Overview

Safari browser artifacts provide comprehensive insight into user web activity on macOS. As the default browser, Safari often contains critical evidence even when users primarily use other browsers.

Analysis Tips

  • History correlation: Match browsing history timestamps with file system activity
  • Download analysis: Cross-reference downloaded files with actual file system presence
  • Cookie forensics: Identify authentication tokens and session data
  • Extension review: Look for suspicious or unauthorized browser extensions
  • Session reconstruction: Use LastSession.plist to understand user's browsing state

Core Data Timestamps

Safari uses Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC):

Core Data timestamp = Unix timestamp - 978307200

Related Artifacts

  • Shell History - Command-line downloads correlate with browser activity
  • FSEvents - File operations from downloads and cache writes

References

Data sources

History.dbSQLite

~/Library/Safari/

Browsing history with visit timestamps and counts

Downloads.plistBinary Plist

~/Library/Safari/

Download records with URLs, paths, and timestamps

Bookmarks.plistBinary Plist

~/Library/Safari/

User bookmarks and Reading List items

Cookies.binarycookiesBinary

~/Library/Cookies/

Session and persistent cookies

Extensions.plistBinary Plist

~/Library/Safari/Extensions/

Installed Safari extensions

LastSession.plistBinary Plist

~/Library/Safari/

Tabs and windows from last session