Get macfor Pro

Community plugin

Safari Browser

Collects Safari browsing history, downloads, bookmarks, cookies, extensions, local storage, and session data

browser.safariCommunitymacOS 10.12+v1.0.0browseruserweb

Run this plugin

Trigger collection for Safari Browser on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor collect --plugin browser.safari --output ./evidence.zip

# Dry run — list what would be collected
macfor collect --plugin browser.safari --dry-run

Compatibility

  • macOS 10.12+

Artifacts (7 collected, 5 planned)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

history

ArtifactFormatPathNotes
Browsing History
history
sqlite~/Library/Safari/History.db—
Top Sites
top_sitesPlanned — not collected yetOptional
binary_plist~/Library/Safari/TopSites.plist—

downloads

ArtifactFormatPathNotes
Downloads
downloadsOptional
binary_plist~/Library/Safari/Downloads.plist—

bookmarks

ArtifactFormatPathNotes
Bookmarks
bookmarks
binary_plist~/Library/Safari/Bookmarks.plist—

cookies

ArtifactFormatPathNotes
Cookies
cookiesOptionalSensitive
binary_cookies~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookiesmacOS 10.14+
+1 more
  • ~/Library/Cookies/Cookies.binarycookies
—

extensions

ArtifactFormatPathNotes
Extensions
extensionsOptional
binary_plist~/Library/Safari/Extensions/Extensions.plist—

storage

ArtifactFormatPathNotes
Local Storage
local_storageOptional
sqlite~/Library/Safari/LocalStorage/*.localstoragemacOS ≤ 10.15
+1 more
  • ~/Library/WebKit/WebsiteData/LocalStorage/*.localstoragemacOS 11.0+
—

session

ArtifactFormatPathNotes
Last Session
last_sessionOptional
binary_plist~/Library/Safari/LastSession.plist—
Cloud Tabs
cloud_tabsPlanned — not collected yetOptional
sqlite~/Library/Safari/CloudTabs.dbmacOS 11.0+—
Tab Groups
tab_groupsPlanned — not collected yetOptional
sqlite~/Library/Safari/SafariTabs.dbapp 15.0+—
Recently Closed Tabs
recently_closedPlanned — not collected yetOptional
binary_plist~/Library/Safari/RecentlyClosedTabs.plistmacOS 10.13+—

cache

ArtifactFormatPathNotes
Favicon Cache
faviconsPlanned — not collected yetOptionallow value
sqlite~/Library/Safari/Favicon Cache/favicons.db—