Skip to content

Forensic Bookmark.plist from Safari

I was reading some documents on Mac Os X forensic, and I was searching how to get back the Bookmark.plist from safari to parse it and read it easily. I knew that this file is located in the following folder :

I was thinking that “plist” files where always XML documents and tried with python to read the file. I opened python and typed the following commands.

But got an error,  I got back to my shell and tried to read it with

[…] and as Python said, it was not an XML file, I directly decide to go to  developer.apple.com/ , to find the proper way to use “plist” files and find out that some of them are in the following format :

But I also discovered that there was an “app” for that (inside joke).

Using this command, you obtain a proper XLM file.

Post a Comment

Your email is never published nor shared. Required fields are marked *