Safari Cached Web Content (Cache.db)

Location

Description

SQLite database and associated blob storage containing cached web page resources including HTML content, images, JavaScript files, CSS stylesheets, and API responses from websites visited in Safari. Cache entries include the request URL, response headers, content type, and the cached resource data.

Forensic Value

The Safari cache preserves actual web page content that was displayed to the user, providing evidence of what was seen even after browsing history is cleared. Cached HTML and images from webmail interfaces may contain email content. API response data cached from web applications can reveal application state and user data. Cache entries persist independently of browsing history and may contain content from sessions where history was deleted or private browsing was not used. Timestamps on cache entries provide additional timeline data for web activity reconstruction.

Tools Required

Collection Commands

idevicebackup2 backup --full /forensics/ios_backup/

python3 ileapp.py -t tar -i /path/to/backup -o /forensics/output/

python3 meat.py -i -o /forensics/output/ -t backup

Collection Constraints

• •Availability depends on iOS version, device lock state, backup class, and extraction method. Many protected domains require a full filesystem extraction or sysdiagnose rather than a standard backup.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References