Introduction
Safari is a web browser developed by apple.com and serves as the default browser for macOS, iPhone, iPad, and other Apple devices.
Since its introduction in 2003, Safari has become one of the world’s most widely used web browsers, known for its speed, energy efficiency, privacy-focused features, and seamless integration within the Apple ecosystem.
From a digital forensics perspective, Safari can be a valuable source of evidence.
User activities such as website visits, searches, downloads, saved passwords, cookies, bookmarks, and browsing sessions may leave artefacts on a device.
These artefacts can assist investigators in reconstructing user behaviour, establishing timelines, and identifying online activity relevant to civil, criminal, or corporate investigations.
History of Safari
Safari was first released by Steve Jobs on January 7, 2003, during the Macworld Conference and Expo. Before Safari, Apple computers primarily relied on third-party browsers such as Internet Explorer.
Key Milestones
2003 – Initial Release – Safari 1.0 was introduced as a public beta for Mac OS X. Built using the WebKit rendering engine, derived from the KHTML engine.
2005 – Safari 2 – Improved standards compliance. Enhanced RSS support and browser performance.
2007 – Safari for Windows – Apple released Safari for Microsoft Windows to expand its market reach.
2007 – iPhone Integration – Safari became the default browser on the original iPhone. Mobile browsing significantly increased Safari’s user base.
2012 – iCloud Synchronisation – Safari integrated with iCloud, allowing bookmarks, tabs, and browsing data to synchronise across devices.
2017 onwards – Privacy Enhancements – Introduction of Intelligent Tracking Prevention (ITP). Increased protection against third-party tracking and fingerprinting.
Current Versions
Safari remains the default browser on macOS, iOS, and iPadOS.
Continues to focus on privacy, performance, and battery efficiency.
Safari Architecture
Safari utilises Apple’s WebKit browser engine, which is responsible for rendering webpages and executing web content.
Key components include:
- WebKit rendering engine
- JavaScript engine (JavaScriptCore)
- Networking services
- Local storage databases
- Cookie management
- Bookmark management
- Cache storage
- Synchronisation services through iCloud
Each component may generate forensic artefacts that can be examined during an investigation.
Safari Forensic Artefacts
Safari stores a variety of data that may reveal user activity.
Browsing History
Browsing history records websites visited by the user.
Common Artefact – History.db
Typical location:
macOS – ~/Library/Safari/History.db
This SQLite database may contain:
- Visited URLs
- Page titles
- Visit timestamps
- Redirect information
- Frequency of visits
Investigators can use this data to establish browsing patterns and timelines.
Bookmarks
Safari stores bookmarked websites for future access.
Artefact – Bookmarks.plist
Location: ~/Library/Safari/Bookmarks.plist
May contain:
- Saved website URLs
- Bookmark folder structures
- Creation dates
- User-organised categories
Bookmarks can provide insight into a user’s interests and frequently accessed resources.
Download History
Safari maintains records of downloaded files.
Artefact – Downloads.plist and History.db
Information may include:
- Downloaded file names
- Source URLs
- Download dates and times
- File locations
Download records may remain available even when downloaded files have been deleted.
Cookies
Cookies are small files stored by websites to maintain user sessions and preferences.
Artefact – Cookies.binarycookies
Typical location: ~/Library/Cookies/
May contain:
- Website domains
- Session identifiers
- Login tokens
- User preferences
- Tracking information
Cookies can help establish account usage and website interactions.
Cached Web Content
Safari caches webpages and media files to improve performance.
Cache Locations – ~/Library/Caches/com.apple.Safari/
Cached artefacts may include:
- Images
- HTML pages
- JavaScript files
- CSS files
- Temporary web content
Even after browsing history is cleared, cached data may remain recoverable.
Search History
Searches conducted through search engines may be stored in:
- History databases
- Browser caches
- Local storage files
Search terms can provide valuable context regarding a user’s intentions, interests, or activities.
Session Restoration Data
Safari supports restoring tabs and browser sessions.
Artefacts – LastSession.plist and RecentlyClosedTabs.plist
These files may reveal:
- Open tabs
- Recently closed tabs
- Session timestamps
- Previously viewed webpages
This information can assist in reconstructing browser activity immediately before device shutdown.
Local Storage and Website Data
Modern websites often store data locally.
Locations – ~/Library/Safari/LocalStorage/ and ~/Library/WebKit/
May contain:
- User preferences
- Authentication tokens
- Chat session data
- Application-specific information
Local storage frequently survives browser restarts.
Saved Passwords and Keychain Data
Safari integrates with Apple’s Keychain service.
Artefact Source – Keychain Access
May contain:
- Saved usernames
- Website credentials
- Wi-Fi passwords
- Certificates
Access generally requires appropriate permissions or forensic acquisition methods.
iCloud Synchronisation Data
Safari synchronises data across Apple devices through iCloud.
Potential evidence includes:
- Synced bookmarks
- Open tabs
- Reading lists
- Browsing activity
Where legally authorised, cloud-based evidence may supplement data recovered from physical devices.
Safari Artefacts on iOS Devices
On iPhones and iPads, Safari data is stored within application containers and system databases.
Common artefacts include:
- Browser history databases
- Bookmarks
- Cookies
- Cached files
- Search history
- Tab information
- Reading lists
Forensic acquisition tools can often extract these artefacts from logical, file system, or full forensic images depending on device security and operating system version.
Forensic Significance of Safari Artefacts
Safari artefacts can help investigators:
- Establish browsing timelines
- Identify visited websites
- Determine search activity
- Recover evidence of downloads
- Correlate user actions with other device activity
- Attribute online behaviour to specific users
- Support civil, criminal, employment, and family court investigations
When combined with artefacts from other applications and operating system logs, Safari evidence can provide a detailed picture of a user’s online activities.
Challenges in Safari Forensics
Investigators may encounter several challenges:
- Private Browsing mode reduces stored artefacts.
- Encrypted Apple devices restrict access.
- iCloud synchronisation may alter timestamps.
- Users can manually clear browsing data.
- New Safari versions continually change storage locations and structures.
Despite these challenges, residual artefacts frequently remain available through forensic examination techniques.
Conclusion
Safari is Apple’s flagship web browser and a major source of digital evidence on macOS and iOS devices.
Since its launch in 2003, Safari has evolved into a fast, secure, and privacy-focused browser while continuing to generate valuable forensic artefacts.
Databases, cookies, caches, bookmarks, downloads, local storage, and synchronised cloud data can all provide investigators with critical information about user activity.
As a result, Safari remains an important area of examination in digital forensic investigations involving Apple devices.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensics investigation.
Our digital forensic experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years. Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
