MOBILE FORENSICS

Safari artefacts

Safari is the web browser installed by default on iPhones and plays an important role in many IT forensic investigations. Depending on the data available, it is possible to analyse, amongst other things, websites visited, search queries, downloads, cookies and other browser artefacts. This information can provide valuable insights into usage behaviour and chronological sequences.

Browser history
Search history
Downloads
Cookies
Cache files
Website data
Tabs and tab groups
Reading list
Favourites
SQLite databases

TECHNICAL BACKGROUND

Technical Fundamentals

Safari stores various types of information locally on the device and, depending on your settings, can also synchronise this via iCloud.

Forensically relevant artefacts may include, amongst other things:

  • Browser history
  • Search history
  • Downloads
  • Cookies
  • Cache files
  • Website data
  • Tabs and tab groups
  • Reading list
  • Favourites
  • SQLite databases
  • Timestamps and metadata

The information available depends on the version of iOS, your privacy settings and the type of backup.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following the forensic data backup, all available Safari artefacts are examined using recognised IT forensic tools and manual analysis. Browser databases, timestamps, cache files and other metadata are cross-referenced to provide a clear picture of the technical relationships.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • Which websites were visited?
  • Which search terms were used?
  • Which downloads were carried out?
  • Is it possible to reconstruct usage times?
  • Which browser data is stored locally or synchronised?

LIMITATIONS & CONCLUSION

What you should know

The extent of the available browser artefacts depends on various factors. Deleted data, private browsing mode, synchronisation processes or changes made by iOS may mean that information is only partially available or no longer available at all. Missing artefacts must not automatically be interpreted as evidence of a lack of browser activity.

Safari artefacts are among the most important sources of data in iPhone forensics. When combined with other system, location and communication data, they often enable a thorough reconstruction of digital activities.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have browser data or Safari artefacts professionally examined? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Can the browser history be examined?
Yes, provided that the relevant artefacts are included in the data backup.
Are search terms stored?
Depending on how you use the service and your settings, relevant information may be available.
Can deleted browser data be recovered?
That depends on the data backup and the artefacts available.
Does iCloud play a part?
Yes. Safari can synchronise various browser data across Apple devices.
Can an expert report be drawn up that is admissible in court?
Yes. The results of the investigations can be documented in a transparent manner and assessed by an expert.