Difference between pages "Apple Safari" and "Property list (plist)"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(History)
 
(Tools)
 
Line 1: Line 1:
{{Expand}}
+
{{expand}}
Apple Safari is the default [[Web Browser|web browser]] included with [[Mac OS X]].
+
  
== Locations ==
+
The '''Property List (plist)''' format is widely used within [[Mac OS X]]. It is used to store various kinds of information, e.g. configuration.
The Safari browser uses different locations to store different kind of information.
+
  
The user directory:
+
There are multiple format variations of plists:
 
+
* Binary plist
On MacOS-X
+
* XML plist
<pre>
+
* JSON plist
/Users/$USER/Library/Safari/
+
</pre>
+
 
+
On Windows XP
+
<pre>
+
C:\Documents and Settings\%USERNAME%\Application Data\Apple Computer\Safari\
+
</pre>
+
 
+
On Windows 7
+
<pre>
+
C:\Users\{user}\AppData\Roaming\Apple Computer\Safari\
+
</pre>
+
 
+
The cache directory:
+
 
+
On MacOS-X
+
<pre>
+
/Users/$USER/Library/Caches/com.apple.Safari/
+
</pre>
+
 
+
On Windows XP
+
<pre>
+
C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Apple Computer\Safari\
+
</pre>
+
 
+
On Windows 7
+
<pre>
+
C:\Users\{user}\AppData\Local\Apple Computer\Safari\
+
</pre>
+
 
+
== History ==
+
The browser history is stored in a [[Property list | binary plist file]] named '''History.plist''' in the user directory.
+
 
+
For each web site, the program records the URL visited, the date and time of the last visit, and the number of times the site has been visited.
+
 
+
The date and time values are stored as a floating point value containing the number of seconds since Jan 1, 2001 00:00:00 UTC.
+
 
+
== Downloads ==
+
The downloads history is stored in a [[Property list | plist file]] named '''Downloads.plist''' in the user directory.
+
 
+
== Last Session ==
+
The browser last session information is stored in a [[Property list | plist file]] named '''LastSession.plist''' in the user directory.
+
 
+
== Cache ==
+
The Safari cache is stored in '''Cache.db''' in the cache directory.
+
 
+
This file uses the [[SQLite database format]].
+
  
 
== External Links ==
 
== External Links ==
  
* [http://www.apple.com/macosx/features/safari/ Official website]
+
* [http://en.wikipedia.org/wiki/Property_list Wikipedia article on Property list]
* [http://www.appleexaminer.com/files/Safari_Cache.db_Revisited.pdf Safari Cache Revisited] by Sean Cavanaugh
+
* [http://opensource.apple.com/source/CF/CF-550/CFBinaryPList.c CFBinaryPList.c] by Apple
* [http://www.appleexaminer.com/MacsAndOS/Analysis/HowTo/SafariBrowserAnalysis/SafariBrowserAnalysis.html Analyzing Apple Safari Artifacts], by Selena Ley
+
* [http://explanatorygap.net/2009/10/30/apple-have-documented-the-binary-plist-format/ Apple have documented the binary plist format]
 +
* [http://digitalinvestigation.wordpress.com/2012/03/08/free-python-module/ Python Module for dealing with Binary Property Lists (bplists)] Documentation
 +
* [http://www.ccl-forensics.com/images/property%20lists%20in%20digital%20forensics%20new.pdf Property Lists in Digital Forensics], by Alex Caithness, 2010
  
 
== Tools ==
 
== Tools ==
* [http://jafat.sourceforge.net/ J.A.F.A.T. Archive of Forensics Analysis Tools] home of Safari Forensic Tools (SFT)
+
* [[binplist]]
 +
* [http://code.google.com/p/ccl-bplist/ Python Module for dealing with Binary Property Lists (bplists)]
 +
* [https://github.com/JonathanBeck/libplist libplist]
 +
* [http://code.google.com/p/munki/ munki - Managed software installation for OS X] comes with code to handle binary plists
 +
* [[Oxygen Forensic Plist Viewer]]
 +
* [http://scw.us/iPhone/plutil/ plutil.pl]
 +
* [[Property List Editor]] program on [[Mac OS X]]
  
[[Category:Applications]]
+
[[Category:File Formats]]
[[Category:Web Browsers]]
+

Revision as of 15:46, 16 December 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

The Property List (plist) format is widely used within Mac OS X. It is used to store various kinds of information, e.g. configuration.

There are multiple format variations of plists:

  • Binary plist
  • XML plist
  • JSON plist

External Links

Tools