Investigating iOS Safari Browser
14/06/2024 Friday
One of the key applications on iOS devices is Safari. Safari is the default web browser in iOS and macOS. This blog will explore the forensic value of Safari artifacts, including their locations and data structures. It will provide insights into how this information can be used in digital investigations and how we can analyze those artifacts using ArtiFast.
Digital Forensics Value of iOS Safari Browser Artifacts
One of the major sources of evidence in digital forensics is Web application activities. Internet browsers in general and Safari browser can be a very rich source. Safari on iOS devices stores data that can be of significant forensic value. These artifacts can reveal a user's web browsing history, search queries, bookmarks, and more. By analyzing these artifacts, forensic investigators can gain insights into the user's online activities, which can be critical in cases involving cybercrimes, fraud, or even personal disputes. The data extracted from Safari can help build a timeline of user actions, identify visited websites, and uncover potential evidence of malicious or suspicious behavior.deletion.
Location and Structure of iOS Safari Browser Artifacts
iOS Safari browser artifact can be found at the following location:
/private/var/ mobile/Library/Safari/SafariTabs.db
/private/var /mobile/Library/Caches/com.apple.Safari.SafeBrowsing/Cache.db
/private/var/mobile/Containers/Data/Application/<App_GUID>/Library/Image Cache/Favicons/Favicons.db
/private/var/ mobile/Library/Safari/Bookmarks.db
/private/var/mobile/Library/Safari/BrowserState.db
/private/var//mobile/Library/Safari/History.db
Analyzing iOS Safari Browser Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Safari Browser artifacts from iOS devices and what kind of digital forensics insight we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Safari Browser artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of the iOS Safari Browser artifacts in ArtiFast.
iOS Safari Browser Artifacts
The artifact contains information related to iOS Safari Browser. The details you can view include:
iOS Safari Browser Cookies:
- URL - The URL of the website
- Name - The name of the cookie.
- Value - The cookie value.
- Expiration Date/Time - The date and time that the cookie expires.
- Is Secure - Indicates whether the connection is secure or not.
- Is Http Only - Indicates whether the browser supports HttpOnly or not.
iOS Safari Browser FavIcons:
- Last Updated Date/Time - The date and time when the Icon URL was last updated.
- Page URL - The URL of the webpage.
- Icon URL - The URL to the icon image.
- Icon Hight - The hight of the icon image.
- Icon Width - The width of the icon image.
iOS Safari Browser History Items:
- URL - The URL that was accessed by the user.
- Visited Date/Time - The date and time that the URL was last visited.
- Visit Count - The number of times the website was visited.
iOS Safari Browser History Visits:
- Title - The title of the webpage
- URL - The URL that was accessed by the user.
- Visited Date/Time - The date and time that the URL was last visited.
- Redircted From - The source webpage.
iOS Safari Browser Bookmarks:
- URL - The URL for the bookmarked website
- Bookmark Title - Title of the bookmark.
- URL - The URL for the bookmarked website
- Parent - The parent bookmark.
- Is syncable - Indicate whether is bookmark is syncable or not
- Is Hiddne - Indicate whether is bookmark is hidden or not
- Is Deleted - Indicate whether is bookmark is deleted or not
iOS Safari Browser Cache:
- URL - The URL of the cached item
- Entry Id - The entry ID
- Receiver Data - The recevied cache data
For more information or suggestions please contact: ekrma.elnour@forensafe.com
