Difference between pages "LinEn" and "Apple Safari"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
 
Line 1: Line 1:
'''Tool Name''' is a ...
+
{{Expand}}
 +
Apple Safari is the default [[Web Browser|web browser]] included with [[Mac OS X]]. The support files for this browser are stored in the user's home directory in <tt>/Users/[username]/Library/Safari/</tt>.
  
 +
== History ==
 +
The Safari browser history is stored in an plist file named '''History.plist''' in the user directory.
  
=Features=
+
On MacOS-X
 +
<pre>
 +
/Users/$USER/Library/Safari/History.plist
 +
</pre>
  
==File Systems Understood==
+
== Cache ==
 +
The Safari cache is stored in '''Cache.db'''. This file uses the [[SQLite database format]].
  
==File Search Facilities==
+
On MacOS-X
 +
<pre>
 +
/Users/$USER/Library/Caches/com.apple.Safari/Cache.db
 +
</pre>
  
==Historical Reconstruction==
+
== Also See ==
 +
[[Apple Safari History File Format]]
  
Can it build timelines and search by creation date?
+
== External Links ==
  
==Searching Abilities==
+
* [http://www.apple.com/macosx/features/safari/ Official website]
 +
* [http://www.appleexaminer.com/files/Safari_Cache.db_Revisited.pdf Safari Cache Revisited] by Sean Cavanaugh
  
Can it search? Does it build an index? Can it focus on file types or particular kinds of metadata?
+
[[Category:Applications]]
 
+
[[Category:Web Browsers]]
==Hash Databases==
+
[[Category:Mac OS X]]
 
+
Can it create hashes of files and/or blocks? Can it compare these hash values to any databases?
+
What sort of hash functions does it use?
+
 
+
It can calculate an MD5 hash.
+
 
+
==Evidence Collection Features==
+
 
+
Can it sign files? Does it keep an audit log?
+
 
+
=History=
+
 
+
==License Notes==
+
 
+
Linen is released under a proprietary license.  It is included as part of the freely downloadable [http://www.e-fense.com/helix/ Helix] live CD.
+
 
+
= External Links =
+
 
+
* [http://www.digitalintelligence.com/software/guidancesoftware/encase/ Official website]
+
* [http://www.guidancesoftware.com/support/articles/acquire_safely.asp How to Acquire a Drive Safely], by Guidance Software
+
 
+
==External Reviews==
+
 
+
[[Category:Disk imaging]]
+

Revision as of 08:24, 3 November 2011

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Apple Safari is the default web browser included with Mac OS X. The support files for this browser are stored in the user's home directory in /Users/[username]/Library/Safari/.

History

The Safari browser history is stored in an plist file named History.plist in the user directory.

On MacOS-X

/Users/$USER/Library/Safari/History.plist

Cache

The Safari cache is stored in Cache.db. This file uses the SQLite database format.

On MacOS-X

/Users/$USER/Library/Caches/com.apple.Safari/Cache.db

Also See

Apple Safari History File Format

External Links