Skip to content

Add Safari (macOS) parser - #87

Open
Gear-I wants to merge 2 commits into
abrignoni:mainfrom
Gear-I:Safaribrowsing
Open

Add Safari (macOS) parser#87
Gear-I wants to merge 2 commits into
abrignoni:mainfrom
Gear-I:Safaribrowsing

Conversation

@Gear-I

@Gear-I Gear-I commented Aug 23, 2026

Copy link
Copy Markdown

Summary

  • Adds `scripts/artifacts/safariBrowsing.py`, six new artifacts under category "Safari (macOS)": History, Bookmarks, Top Sites, Recently Closed Tabs, iCloud Tabs (CloudTabs.db), and Last Session (open tabs).
  • No changes to any existing file -- pure drop-in, picked up automatically by the plugin loader.

Validation

Checked against a real `~/Library/Safari` extracted from Josh Hickman's public macOS Big Sur test image (thisisdfir persona, acquired 2021-02-20), not written from documentation alone:

  • History.db: 22 history items / 27 visits, `visit_time` confirmed as Mac Absolute Time in seconds since 2001-01-01.
  • Bookmarks.plist: 7 real bookmarks-bar entries; confirmed leaf titles live at `URIDictionary.title`, not the top-level `Title` key.
  • TopSites.plist: 12 entries, built-in-vs-earned flagged.
  • RecentlyClosedTabs.plist / LastSession.plist: real closed-window and open-tab data recovered; per-tab `SessionState` binary blob intentionally left undecoded (size reported only).
  • CloudTabs.db: 2 synced tabs from 1 real device joined via `cloud_tab_devices`.

Co-Author by Claude Sonnet 5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant