We are conspiracy
Posts tagged plutil
Forensic Bookmark.plist from Safari
0I was reading some documents on Mac Os X forensic, and I was searching
how to get back the Bookmark.plist from safari to parse it and read it easily …
I knew that this file is located in the following folder :
~Library/Safary/Bookmarks.plist
I was thinking that plist files where always XML documents and tried with python to read the file, I opened python and typed the following commands.
>>> import plistlib
>>> plist.readPlist('Bookmarks.plist)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/System/Library/Frameworks/Python.framework/Versions/2.6/lib/python2.6/plistlib.py", line 78, in readPlist
rootObject = p.parse(pathOrFile)
File "/System/Library/Frameworks/Python.framework/Versions/2.6/lib/python2.6/plistlib.py", line 405, in parse
parser.ParseFile(fileobj)
xml.parsers.expat.ExpatError: not well-formed (invalid token): line 1, column 9
Yeah ! Error …
I got back to my shell and tried to read it with
$ cat Bookmarsk.plist
[...] it was not an XML output at all !
I directly decide to go to developer.apple.com/ , to find the plist use, and find out that some plist files are in
BINARY FORMAT PROPERTY LISTS
WTF ??
hopefully the command was given to translate it to XML
plutil -convert xml1 -o - Bookmarks.plist
I tried it, and it gave me a cool XML format.
I could then put the output of this command in an XML file and use it.