Converting Binary Plists

From Forensics Wiki
Revision as of 13:39, 20 June 2012 by Joachim Metz (Talk | contribs)

Jump to: navigation, search

Binary plists are the files that Apple products use to store information. The easiest way to view them is to convert them to XML. Note that binary data in XML plist are converted in base64 and therefore strings in the binary data are not directly visible.

The program plutil is native to Mac OS X (as of 10.2), however it is also included when iTunes is installed on a Windows PC. On linux libplist [1] also provides an equivalent of plutil.

plutil on a Windows PC is stored in:

C:\Program Files (x86)\Common Files\Apple\Apple Application Support

Which can be added to the PATH in Environmental variables so plutil can be run from anywhere

To convert Binary plists to XML run the command:

plutil -convert xml1 file.plist

Or with libplist

plutil -i file.plist > file.xml.plist


External Links