Safari Bookmarks
Overview
Section titled “Overview”Evidence: Safari Bookmarks
Description: Collect Safari Bookmarks
Category: Applications
Platform: macos
Short Name: sbkmrks
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Safari bookmarks are the sites and folders a user saved, including Reading List. They show habitual resources and, in an investigation, can point to staging portals, internal tools, or pages the user set aside to read.
Data Collected
Section titled “Data Collected”Parsed rows are stored in the shared browser bookmarks table.
Safari Bookmarks Data
Section titled “Safari Bookmarks Data”| Field | Description | Example |
|---|---|---|
UserName | macOS account that owns the Safari data | Example value |
ProfileName | Parent directory name. For the default Safari file this is Safari | Safari |
BrowserName | Browser name | Safari |
GUID | Safari bookmark UUID | Example value |
BookmarkID | Not set for Safari. The identifier is GUID | Empty |
Name | Bookmark or folder title | Example value |
Type | url or folder | url |
URL | Bookmarked address. Empty for folders | Example value |
ParentFolder | Name of the parent folder. Items directly under a root use the root name | Favorites |
DateAdded | When the bookmark was added, in UTC. Reading List uses its added date. Empty when Safari stores no date | 2023-10-15 14:30:25+03:00 |
DateLastUsed | When a Reading List item was last viewed, in UTC. Empty for other bookmarks | 2023-10-15 14:30:25+03:00 |
DateModified | Not set for Safari | Empty |
FolderPath | Folder chain below the root, joined with / | Design / Type |
Root | Bookmark tree: Favorites, Bookmarks Menu, or Reading List | Favorites |
SourceFile | File the row came from | Bookmarks.plist |
Collection Method
Section titled “Collection Method”The collector reads ~/Library/Safari/Bookmarks.plist and parses Favorites, Bookmarks Menu, and Reading List. Reading List items include the date they were added and the date they were last viewed.
Forensic Value
Section titled “Forensic Value”Bookmark analysis identifies targeted websites, phishing pages, command-and-control servers, internal resources, and organizational reconnaissance patterns. Reading List entries show pages the user saved to return to, which can include staging sites or research the user did not keep in Favorites.