Safari Browsing History (History.db)

Location

Description

SQLite database containing the complete Safari browsing history including visited URLs, page titles, visit counts, and timestamps for each visit. The history_items table stores unique URLs while the history_visits table records individual visits with precise timestamps and redirect source references enabling reconstruction of navigation chains.

Forensic Value

Safari browsing history reveals research activity, accessed resources, and web-based communications that establish intent and knowledge. Redirect chains captured in the history_visits table can trace phishing click-throughs from initial lure URL to final payload delivery. Visit timestamps correlated with other device activity establish what the user was doing at specific times. URLs for cloud storage services, webmail, paste sites, and file sharing platforms may indicate data exfiltration or command-and-control activity. Deleted history entries may be recoverable from SQLite WAL files and unallocated database pages.

Tools Required