Safari Favicons
Overview
Section titled “Overview”Evidence: Safari Favicons
Description: Collect Safari Favicons
Category: Applications
Platform: macos
Short Name: sfico
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”Browsers cache the icon of each page they render and record which page the icon belongs to. The favicon database is kept apart from browsing history, so its page URLs corroborate visits from a second source.
Data Collected
Section titled “Data Collected”Parsed rows are stored in browser_favicons.
Safari Favicons Data
Section titled “Safari Favicons Data”| Field | Description | Example |
|---|---|---|
ID | ID | 123 |
UserName | User Name | Example value |
BrowserName | Browser Name | Safari |
Profile | Profile | Example value |
URL | Icon URL | Example value |
IconType | Icon Type | 123 |
Path | Path | Example value |
PageURL | Page the icon belongs to | https://example.com/page |
LastUpdated | Chromium icon time, in UTC. Empty for Firefox and Safari | 2023-10-15 14:30:25+03:00 |
ExpiresAt | Firefox mapping expiry, in UTC. Empty for other browsers | 2023-10-15 14:30:25+03:00 |
IconTimestamp | Safari icon time, in UTC. Empty for other browsers | 2023-10-15 14:30:25+03:00 |
Collection Method
Section titled “Collection Method”The collector copies the favicon database and its -wal, -shm, and -journal companions into the case, then parses page URL and icon URL pairs. Safari icon image files under Favicon Cache/favicons are copied as well. It looks under:
/Users/*/Library/Safari/Favicon Cache/favicons.db
Forensic Value
Section titled “Forensic Value”Page and icon URL pairs show which pages the browser loaded, including full URLs with query strings, and can be correlated with history, downloads, and other browser artifacts. Clearing history in the browser also removes matching favicon data.