Community plugin

Safari Browser

Collects Safari browsing history, downloads, bookmarks, cookies, extensions, local storage, and session data

browser.safariCommunitymacOS 10.12+v1.0.0browseruserweb

Run this plugin

Trigger collection for Safari Browser on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor collect --plugin browser.safari --output ./evidence.zip

# Dry run — list what would be collected
macfor collect --plugin browser.safari --dry-run

Compatibility

macOS 10.12+

Artifacts collected (12)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

history

Artifact	Format	Path	Notes
Browsing History history	sqlite	`~/Library/Safari/History.db`	—
Top Sites top_sitesOptional	binary_plist	`~/Library/Safari/TopSites.plist`	—

downloads

Artifact	Format	Path	Notes
Downloads downloadsOptional	binary_plist	`~/Library/Safari/Downloads.plist`	—

bookmarks

Artifact	Format	Path	Notes
Bookmarks bookmarks	binary_plist	`~/Library/Safari/Bookmarks.plist`	—

cookies

Artifact	Format	Path	Notes
Cookies cookiesOptionalSensitive	binary_cookies	`~/Library/Cookies/Cookies.binarycookies` +1 more ~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies	—

extensions

Artifact	Format	Path	Notes
Extensions extensionsOptional	binary_plist	`~/Library/Safari/Extensions/Extensions.plist`	—

storage

Artifact	Format	Path	Notes
Local Storage local_storageOptional	sqlite	`~/Library/Safari/LocalStorage/.localstorage` +1 more ~/Library/WebKit/WebsiteData/LocalStorage/.localstorage	—

session

Artifact	Format	Path	Notes
Last Session last_sessionOptional	binary_plist	`~/Library/Safari/LastSession.plist`	—
Cloud Tabs cloud_tabsOptional	sqlite	`~/Library/Safari/CloudTabs.db`	—
Tab Groups tab_groupsOptional	sqlite	`~/Library/Safari/SafariTabs.db`	—
Recently Closed Tabs recently_closedOptional	binary_plist	`~/Library/Safari/RecentlyClosedTabs.plist`	—

cache

Artifact	Format	Path	Notes
Favicon Cache faviconsOptionallow value	sqlite	`~/Library/Safari/Favicon Cache/favicons.db`	—