I was reading some documents on Mac Os X forensic, and I was searching how to get back the Bookmark.plist from safari to parse it and read it easily. I knew that this file is located in the following folder :
|
1 |
~Library/Safary/Bookmarks.plist |
I was thinking that “plist” files where always XML documents and tried with python to read the file. I opened python and typed the following commands.
|
1 2 3 4 5 6 7 8 9 10 |
>>> import plistlib >>> plist.readPlist('Bookmarks.plist) Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/System/Library/Frameworks/Python.framework/Versions/2.6/lib/python2.6/plistlib.py", line 78, in readPlist rootObject = p.parse(pathOrFile) File "/System/Library/Frameworks/Python.framework/Versions/2.6/lib/python2.6/plistlib.py", line 405, in parse parser.ParseFile(fileobj) xml.parsers.expat.ExpatError: not well-formed (invalid token): line 1, column 9 |
But got an error, I got back to my shell and tried to read it with
|
1 |
$ cat Bookmarsk.plist |
[…] and as Python said, it was not an XML file, I directly decide to go to developer.apple.com/ , to find the proper way to use “plist” files and find out that some of them are in the following format :
|
1 |
<tt><tt><strong>BINARY</strong> <strong>FORMAT</strong> <strong>PROPERTY</strong> <strong>LISTS</strong></tt></tt> |
But I also discovered that there was an “app” for that (inside joke).
|
1 |
<tt><tt>plutil -convert xml1 -o - Bookmarks.plist</tt></tt> |
Using this command, you obtain a proper XLM file.
Post a Comment