forensic-artifacts 20170808-1 / usr / share / artifacts / webbrowser.yaml

# Web browser artifacts.

name: BrowserCache
doc: Web browser cache of multiple web browsers.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
      - 'ChromeCache'
      - 'FirefoxCache'
      - 'InternetExplorerCache'
      - 'SafariCache'
labels: [Browser]
supported_os: [Darwin,Linux,Windows]
---
name: BrowserHistory
doc: Web browser history of multiple web browsers.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
      - 'ChromeHistory'
      - 'FirefoxHistory'
      - 'InternetExplorerHistory'
      - 'OperaHistory'
      - 'SafariHistory'
labels: [Browser]
supported_os: [Darwin,Linux,Windows]
---
name: ChromeCache
doc: |
  Google Chrome, Canary and Chromium browser caches.

  Canary uses "Chrome SxS" on windows.

  * Disk cache (or Cache)
  * Media cache
  * Application cache
  * GPU shader cache
  * PNaCl translation cache
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Application Cache\Cache\*'
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Cache\*'
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Media Cache\*'
      - '%%users.localappdata%%\Google\Chrome\User Data\*\GPUCache\*'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Application Cache\Cache\*'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Cache\*'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Media Cache\*'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\GPUCache\*'
      - '%%users.localappdata%%\Chromium\User Data\*\Application Cache\Cache\*'
      - '%%users.localappdata%%\Chromium\User Data\*\Cache\*'
      - '%%users.localappdata%%\Chromium\User Data\*\Media Cache\*'
      - '%%users.localappdata%%\Chromium\User Data\*\GPUCache\*'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Caches/Google/Chrome/*/Cache/*'
      - '%%users.homedir%%/Library/Caches/Google/Chrome/*/Cache/*'
      - '%%users.homedir%%/Library/Caches/Google/Chrome/*/Media Cache/*'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Application Cache/Cache/*'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/GPUCache/*'
      - '%%users.homedir%%/Library/Caches/Google/Chrome/PnaclTranslationCache/*'
      - '%%users.homedir%%/Caches/Google/Chrome Canary/*/Cache/*'
      - '%%users.homedir%%/Library/Caches/Google/Chrome Canary/*/Cache/*'
      - '%%users.homedir%%/Library/Caches/Google/Chrome Canary/*/Media Cache/*'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Application Cache/Cache/*'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/GPUCache/*'
      - '%%users.homedir%%/Library/Caches/Google/Chrome Canary/PnaclTranslationCache/*'
      - '%%users.homedir%%/Caches/Chromium/*/Cache/*'
      - '%%users.homedir%%/Library/Caches/Chromium/*/Cache/*'
      - '%%users.homedir%%/Library/Caches/Chromium/*/Media Cache/*'
      - '%%users.homedir%%/Library/Application Support/Chromium/*/Application Cache/Cache/*'
      - '%%users.homedir%%/Library/Application Support/Chromium/*/GPUCache/*'
      - '%%users.homedir%%/Library/Caches/Chromium/PnaclTranslationCache/*'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/.cache/google-chrome/*/Cache/*'
      - '%%users.homedir%%/.cache/google-chrome/*/Media Cache/*'
      - '%%users.homedir%%/.cache/google-chrome/PnaclTranslationCache/*'
      - '%%users.homedir%%/.config/google-chrome/*/Application Cache/*'
      - '%%users.homedir%%/.config/google-chrome/*/Cache/*'
      - '%%users.homedir%%/.config/google-chrome/*/Media Cache/*'
      - '%%users.homedir%%/.config/google-chrome/*/GPUCache/*'
      - '%%users.homedir%%/.cache/chromium/*/Cache/*'
      - '%%users.homedir%%/.cache/chromium/*/Media Cache/*'
      - '%%users.homedir%%/.cache/chromium/PnaclTranslationCache/*'
      - '%%users.homedir%%/.config/chromium/*/Application Cache/*'
      - '%%users.homedir%%/.config/chromium/*/Cache/*'
      - '%%users.homedir%%/.config/chromium/*/Media Cache/*'
      - '%%users.homedir%%/.config/chromium/*/GPUCache/*'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['http://www.forensicswiki.org/wiki/Google_Chrome']
---
name: ChromeHistory
doc: Chrome browser history.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Archived History'
      - '%%users.localappdata%%\Google\Chrome\User Data\*\History'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Archived History'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\History'
      - '%%users.localappdata%%\Chromium\User Data\*\Archived History'
      - '%%users.localappdata%%\Chromium\User Data\*\History'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Archived History'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/History'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Archived History'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/History'
      - '%%users.homedir%%/Library/Application Support/Chromium/*/Archived History'
      - '%%users.homedir%%/Library/Application Support/Chromium/*/History'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/.config/google-chrome/*/Archived History'
      - '%%users.homedir%%/.config/google-chrome/*/History'
      - '%%users.homedir%%/.config/chromium/*/Archived History'
      - '%%users.homedir%%/.config/chromium/*/History'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['http://www.forensicswiki.org/wiki/Google_Chrome']
---
name: ChromeExtensionActivity
doc: Chrome Extension Activity database.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Extension Activity'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Extension Activity'
      - '%%users.localappdata%%\Chromium\User Data\*\Extension Activity'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Extension Activity'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Extension Activity'
      - '%%users.homedir%%/Library/Application Support/Chromium/*/Extension Activity'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/.config/google-chrome/*/Extension Activity'
      - '%%users.homedir%%/.config/chromium/*/Extension Activity'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['http://forensicswiki.org/wiki/Google_Chrome#Extension_Activity_database']
---
name: ChromeExtensions
doc: Chrome browser extension files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Extensions\**10'
      - '%%users.localappdata%%\Chromium\User Data\*\Extensions\**10'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Extensions\**10'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Extensions/**10'
      - '%%users.homedir%%/Library/Application Support/Chromium/*/Extensions/**10'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Extensions/**10'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/.config/google-chrome/*/Extensions/**10'
      - '%%users.homedir%%/.config/google-chrome-beta/*/Extensions/**10'
      - '%%users.homedir%%/.config/chromium/*/Extensions/**10'
  supported_os: [Linux]
supported_os: [Windows, Darwin, Linux]
labels: [Browser]
urls: ['http://forensicswiki.org/wiki/Google_Chrome#Extensions']
---
name: ChromeExtensionRegistryKeys
doc: Chrome extensions installed by writing windows registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\**5'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Google\Chrome\Extensions\**5'
labels: [Browser]
supported_os: [Windows]
urls: ['https://developer.chrome.com/extensions/external_extensions#registry']
---
name: ChromePreferences
doc: Chrome Preferences file.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Preferences'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Preferences'
      - '%%users.localappdata%%\Chromium\User Data\*\Preferences'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Preferences'
      - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Preferences'
      - '%%users.homedir%%/Library/Application Support/Chromium/*/Preferences'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/.config/google-chrome/*/Preferences'
      - '%%users.homedir%%/.config/chromium/*/Preferences'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['http://forensicswiki.org/wiki/Google_Chrome#Configuration']
---
name: FirefoxCache
doc: Mozilla Firefox browser caches.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*.default\Cache\*'
      - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*.default\cache2\*'
      - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*.default\cache2\doomed\*'
      - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*.default\cache2\entries\*'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/Cache/*'
      - '%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/*'
      - '%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/doomed/*'
      - '%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/entries/*'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/.cache/.mozilla/firefox/*.default/Cache/*'
      - '%%users.homedir%%/.cache/.mozilla/firefox/*.default/cache2/*'
      - '%%users.homedir%%/.cache/.mozilla/firefox/*.default/cache2/doomed/*'
      - '%%users.homedir%%/.cache/.mozilla/firefox/*.default/cache2/entries/*'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['http://forensicswiki.org/wiki/Mozilla_Firefox']
---
name: FirefoxHistory
doc: Firefox browser history (places.sqlite).
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*\places.sqlite'
      - '%%users.appdata%%\Mozilla\Firefox\Profiles\*\places.sqlite'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/places.sqlite']}
  supported_os: [Darwin]
- type: FILE
  attributes: {paths: ['%%users.homedir%%/.mozilla/firefox/*/places.sqlite']}
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['http://www.forensicswiki.org/wiki/Mozilla_Firefox']
---
name: InternetExplorerBrowserHelperObjects
doc: Loaded on Internet Explorer startup
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
- 'https://code.google.com/p/regripper/wiki/ASEPs'
---
name: InternetExplorerCache
doc: |
  Microsoft Internet Explorer (MSIE) browser cache.

  * MSIE 4 - 9 Temporary Internet files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Content.IE5\*\*'
      - '%%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\*\*'
    separator: '\'
labels: [Browser]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Internet_Explorer']
---
name: InternetExplorerCookies
doc: |
  Microsoft Internet Explorer (MSIE) browser cookies.

  * MSIE 4 - 9 Cache files (index.dat)
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.appdata%%\Microsoft\Windows\Cookies\index.dat'
      - '%%users.appdata%%\Microsoft\Windows\Cookies\Low\index.dat'
    separator: '\'
labels: [Browser]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Internet_Explorer']
---
name: InternetExplorerHistory
doc: |
  Microsoft Internet Explorer (MSIE) browser history.

  * MSIE 4 - 9 Cache files (index.dat);
  * MSIE 10 WebCacheV*.dat files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat'
      - '%%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat'
      - '%%users.localappdata%%\Microsoft\Windows\History\History.IE5\index.dat'
      - '%%users.localappdata%%\Microsoft\Windows\History\Low\History.IE5\index.dat'
      - '%%users.localappdata%%\Microsoft\Windows\History\History.IE5\*\index.dat'
      - '%%users.localappdata%%\Microsoft\Windows\History\Low\History.IE5\*\index.dat'
      - '%%users.userprofile%%\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat'
      - '%%users.appdata%%\Microsoft\Windows\IEDownloadHistory\index.dat'
      - '%%users.localappdata%%\Microsoft\Windows\WebCache\WebCacheV*.dat'
    separator: '\'
labels: [Browser]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Internet_Explorer']
---
name: InternetExplorerProtectedModeElevationPolicies
doc: |
  Trust levels of apps launched from low rights IE sessions.

  The ElevationPolicy dictates how IE handles applications that want to execute
  in other applications that reside outside of the Low Rights IE session.

  * AppName is the executable
  * AppPath is the directory
  * CLSID is used if it launches a COM server through CoCreateInstance
  * Policy (DWORD) is the trust level, of 0 through 3.

  * 3 Protected Mode silently launches the broker as a medium integrity process.
  * 2 Protected Mode prompts the user for permission to launch the process. If
      permission is granted, the process is launched as a medium integrity process.
  * 1 Protected Mode silently launches the broker as a low integrity process.
  * 0 Protected Mode prevents the process from launching.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'Policy'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'AppName'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'AppPath'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'CLSID'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'Policy'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'AppName'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'AppPath'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'CLSID'}
labels: [Browser]
supported_os: [Windows]
urls:
 - 'http://blogs.technet.com/b/juanand/archive/2010/10/29/internet-explorer-protected-mode-elevation-policy-and-administrative-templates.aspx'
 - 'https://msdn.microsoft.com/en-us/library/bb250462(VS.85).aspx'
---
name: InternetExplorerProtectedModeDisable
doc: |
  Microsoft Internet Explorer (MSIE) Protected Mode Banner can be suppressed
  by setting NoProtectedModeBanner.

  * Applies to versions 7-11
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner']}
labels: [Browser]
supported_os: [Windows]
urls: ['http://www.blackforce.co.uk/2014/01/07/disable-protected-mode-is-turned-off-for-the-internet-zone-group-policy']
---
name: InternetExplorer6Settings
doc: Registry keys affecting default behavior for Microsoft Internet Explorer 6.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'AboutURLs'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'UrlSearchHooks'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'Extensions'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'ExplorerBars'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'Toolbar'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'SearchURL'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Default_Page_URL'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Default_Search_URL'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Search Page'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Start Page'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Search Bar'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search', value: 'CustomizeSearch'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'UrlSearchHooks'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'Extensions'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'ExplorerBars'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'Toolbar'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'SearchURL'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Default_Page_URL'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Default_Search_URL'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Search Page'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Start Page'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Search Bar'}
labels: [Browser]
supported_os: [Windows]
urls:
  - 'https://support.microsoft.com/en-us/kb/895339'
  - 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: InternetExplorerTypedURLsKeys
doc: Microsoft Internet Explorer TypedUrls keys.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\TypedURLs\*']}
labels: [Browser]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Internet_Explorer#Typed_URLs']
---
name: OperaHistory
doc: Opera browser history (global_history.dat).
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Opera//global_history.dat']}
  supported_os: [Darwin]
- type: FILE
  attributes: {paths: ['%%users.homedir%%/.opera/global_history.dat']}
  supported_os: [Linux]
- type: FILE
  attributes:
    paths:
      - '%%users.appdata%%\Opera\Opera\global_history.dat'
      - '%%users.appdata%%\Opera Software\Opera Stable\History'
    separator: '\'
  supported_os: [Windows]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['http://www.forensicswiki.org/wiki/Opera']
---
name: SafariCache
doc: Safari browser cache (cache.db).
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Apple Computer\Safari\cache.db']
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Caches/com.apple.Safari/cache.db']}
  supported_os: [Darwin]
supported_os: [Windows, Darwin]
labels: [Browser]
urls: ['http://www.forensicswiki.org/wiki/Apple_Safari']
---
name: SafariHistory
doc: Safari browser history (History.plist).
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Apple Computer\Safari\History.plist'
      - '%%users.appdata%%\Apple Computer\Safari\History.plist'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Library/Safari/History.plist'
      - '%%users.homedir%%/Library/Safari/History.db'
      - '%%users.homedir%%/Library/Safari/History.db-wal'
  supported_os: [Darwin]
supported_os: [Windows, Darwin]
labels: [Browser]
urls: ['http://www.forensicswiki.org/wiki/Apple_Safari']