This script parses the records from the bookmarks table in SafariTabs.db SQLite database files.

The primary mode of output is bookmarks albeit the examiner can choose to write the resultant data into a logical evidence file. This will allow embedded property-list data to be examined in more detail.

It’s important to note that the main aim of the script is to retrieve tab-names and their associated URLs. Accordingly, it may be necessary to read additional values from the database to better understand the significance of redundant data that has accumulated over time.

Feedback is provided via the console window.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training