Wednesday, July 26, 2017
Home / Tutorials / Safari Forensic Tutorial

Safari Forensic Tutorial

Introduction

In Mac OS X, iOS and in many apple products store serialized objects in property list files (.plist). These file are used to store information of applications, bundles, User settings. These files are of two types namely binary property lists and XML property lists. XML plist files can be directly viewed from any program which process XML files while binary plist files should be converted to plain text for investigation.

Location of Safari Property List Files
We will be investigating the files under the following locations.

Windows XP:
C:\Documents and Settings\%username\Application Data\Apple Computer\Safari
Windows Vista and 7:
%appdata%\Apple Computer\Safari
Mac OS X:
/Users/$username/Library/Safari

I will be discussing the main objectives in the Safari Browser:

  • History.plist
  • Downloads.plist
  • Bookmarks.plist
  • Cookies.binarycookies
  • cache.db

I will be using SFT tool(http://jafat.sourceforge.net/files.html) in all examples

History.plist
This file stores the visited URLs along with last visited date and time, number of visits, page title. Here is an example of my Computer.
Code:

URL Last Visit Date/Time Number of visits Page Title
http://www.nytimes.com/ 2013-04-06 13:06:26 -0700 1 The New York Times - Breaking News, World News & Multimedia
http://pastebin.com/raw.php?i=qiktzpfU 2013-04-06 13:06:16 -0700 1 http://www.hackthis.co.uk/?login 2013-04-06 13:04:23 -0700 1 HackThis!! - The Hackers Playground
http://hackthis.co.uk/ 2013-04-06 13:04:13 -0700 1 HackThis!! - The Hackers Playground
http://www.youtube.com/ 2013-04-06 13:03:54 -0700 1 YouTube
http://www.wikipedia.org/ 2013-04-06 13:03:45 -0700 1 Wikipedia
http://www.apple.com/startpage/ 2013-04-06 12:52:53 -0700 1 Apple - Start

Downloads.plist
This file contains the entries of downloaded files and does not contain any cache files including images or any media. We can view this file using the SFT tool safari_downloads in this manner. This is a example from my Computer.

Code:

DownloadEntryProgressBytesSoFar: 5900
DownloadEntryPath: C:\Users\Un0wn\Downloads\24897.rb
DownloadEntryIdentifier: 59990399-A44C-CE40-B79D-07B2F99DAF66
DownloadEntryURL: http://www.exploit-db.com/download/24897/ DownloadEntryPro
gressTotalToLoad: 5900 Status: Completed

Bookmarks.plist
This file contains all the saved bookmarked URLs. This file can be processed by the SFT tool sft_bm.
Code:

Folder Title: BookmarksBar
URL_Title: Apple URL: http://
www.apple.com/
URL_Title: Yahoo! URL: http://www.yahoo.com/
URL_Title: Google Maps URL: http://maps.google.com/
URL_Title: YouTube URL: http://www.youtube.com/
URL_Title: Wikipedia URL: http://www.wikipedia.org/
: Folder Title: News
URL_Title: CNN URL: http://www.cnn.com/
URL_Title: The New York Times URL: http://www.nytimes.com/
URL_Title: Google News URL: feed://news.google.com/?output=rss
URL_Title: CNET News.com URL: http://www.news.com/
URL_Title: ESPN URL: http://espn.go.com/
URL_Title: Los Angeles Times URL: http://www.latimes.com/
URL_Title: BBC News URL: http://news.bbc.co.uk/
URL_Title: NPR URL: http://www.npr.org/
URL_Title: USA Today URL: http://www.usatoday.com/
: Folder Title: Popular
URL_Title: eBay URL: http://www.ebay.com/
URL_Title: Amazon URL: http://www.amazon.com/
URL_Title: Flickr URL: http://www.flickr.com/
URL_Title: Expedia Travel URL: http://www.expedia.com/
URL_Title: Orbitz URL: http://www.orbitz.com/
URL_Title: Facebook URL: https://www.facebook.com/
URL_Title: Monster Jobs URL: http://www.monster.com/
URL_Title: CareerBuilder URL: http://www.careerbuilder.com/
URL_Title: Disney URL: http://disney.go.com/
URL_Title: craigslist URL: http://www.craigslist.org/

Cookies.binarycookies
This file contains all the information related to cookies. This file can be parsed by safari_cookie_bin. This file is located inside the cookie folder in the same location. This includes the URL, the creation and expiration time, the cookie content.

Code:

URL Name Created Expires Path Contents
.www.yahoo.com fpc 2013-04-06T16:28:48.000000Z 2014-04-06T03:56:58.000000Z / d=XMMvkO9wskhnek5BFnXSQoS5xdSWt6RrvSXAb7X6p.cXsMbbkCVttT1bp7PzRMsBgcOnrXvfttHiyOu3bFFSn_wSXgb2NzFEDSNqWKUb9YrnHaH5opWITf54YIYq6CT4Hja.fRE7RcmW5Jy0aqBKhe2RiIuCU0.q0tSl_BoX3NMi9zsbyiEAsvy7lY1xhv7eEfVQwOc-&v=2
.www.yahoo.com fpms 2013-04-07T01:40:34.000000Z 2014-04-07T01:40:33.000000Z / p_30345810=%7B%22stream_filter%22%3A%22%3A%3A1365300633674%22%7D
rss.nytimes.com MF2 2013-04-06T16:30:11.000000Z 2015-04-06T03:58:23.000000Z / 1r1rot9a9a0ep
www.nytimes.com _chartbeat2 2013-04-06T20:06:41.000000Z 2013-05-06T20:06:41.000000Z / hf0zkn0xymr79ks7.1365265807248.1365278801138.00000000000001
www.nytimes.com krux_segs 2013-04-06T20:06:36.000000Z 2013-04-09T20:06:36.000000Z /
www.nytimes.com kxe_ICdF6_0U&Campaign_ID 2013-04-06T20:06:29.000000Z 2013-04-08T20:06:29.000000Z / nyt2013_163x90_digi_hp_3J3H8&Page=homepage.nytimes.com

Cache.db
The cache files can be easily dumped by the SFT tool safari_wicache. This cache.db file is included the following location.
Code:

C:\Users\%username%\AppData\Local\Apple Computer\Safari
safari_wincache -f cache.db -s C:\cache

And further more you can use sqlite GUI to view these cache files by using this query.
Code:

SELECT * FROM cfurl_cache_receiver_data; Further more if you want to learn about the safari cache.db investigating see the reference.

All property list file can be also processed by a tool called plutil.pl by Pete M. Wilson which is a open source perl script that can convert binary plist files to a XML readable form.

References
http://forensicsfromthesausagefactory.blogspot.com/2010/06/safari-browser-cache-examination-of.html
http://jafat.sourceforge.net/Analyzing_Safari_With_SFT.pdf

This is the last tutorial and from this I conclude the Browser forensic Tutorial Series. Thank you for reading these and I am happy if you learned something new.
-Un0wn_X

About FastFlux

Owner of ZeroSecurity, interested in programming, malware analysis and penetration testing. If you would like to write for the ZeroSecurity team, please use the contact form above.

Check Also

Low Level IPhone programming

Video from JailbreakCon Twitter: @JailbreakCon – http://twitter.com/JailbreakCon “Low Level iPhone Programming (And more!)” by winocm [remotely, …

  • dam

    good stuff