IT Forensics · macOS

Forensic analysis of Safari history – reconstructing web activity on macOS

During normal browser use, Safari stores various pieces of local data which, depending on the version of macOS and Safari, may provide information about websites visited and the duration of use. For forensic analysis, the browsing history is therefore an important source for reconstructing web activity, although it is not sufficient on its own.

Enquire without obligation

Safari allows users to delete their browsing history. Furthermore, private browsing sessions and synchronisation features can affect the traces visible locally. A missing history entry therefore does not prove that a website has never been visited.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We examine existing Safari history and associated browser data within the relevant user profile. URLs, page titles and technically available time information are extracted and cross-referenced with downloads, website data, cache-related traces, unified logs and other artefacts.

Synchronised or deleted data is only assessed to the extent that it can actually be detected on the forensic data source.

Typical areas of application

•Reconstruction of websites visited
•Analysis of web activity over time
•Analysis of phishing and malware incidents
•Examination of research and communication contexts
•Correlation with downloads and file system traces
•Investigation of deleted browser history, insofar as this is technically possible
•Judicial and non-judicial expert reports

This is how the forensic investigation is carried out

Once the evidence has been securely preserved, Safari-related data sets for the relevant user account are identified. History entries are analysed in a structured manner and time stamps are placed within the context of the case.

Suspicious URLs are then cross-referenced with other browser, download and system traces. The analysis distinguishes between a saved history entry, an actual page view and the personal attribution of the activity.

Why is this area of investigation relevant to forensics?

Browser history can provide a very direct indication of web activity and is therefore relevant in numerous studies. At the same time, it may be incomplete due to user actions, private browsing sessions or data cleansing.

A robust assessment therefore utilises Safari history alongside downloads, file system artefacts, DNS or network traces, or other case-specific sources, where available.

Frequently Asked Questions

Can Safari save your browsing history?+
Yes. When using a browser in normal mode, local history data relating to websites you have visited may be stored.
Can the history be deleted?+
Yes. Safari has features for deleting your browsing history.
Does the absence of an entry prove that a page has never been visited?+
No. The history may have been deleted, or an action may have taken place in a context that did not leave a corresponding local history.
Does a log entry show which person visited the website?+
Not on its own. The technical user and session context must also be taken into account.

LanCologne – macOS Forensics in Cologne

Do you need a professional analysis of Safari and browser activity on a Mac? LanCologne can help you with the admissible evidence collection and traceable reconstruction of web activity.

Get in touch now