#----------------------------------------------------------------------------\ Safari Forensic Tools v1.1.1 http://jafat.sourceforge.net Copyright 2007 - Jake Cunningham #----------------------------------------------------------------------------\ Background: =========== The Safari Forensic Tools project consists of a collection of command line utilities written in Objective-C and PERL to parse the files created and used by the Safari web browser. Please see the README files in the individual tools directories for specific information about each tool. Contents: ========== safari_hist (v1.1) : Safari History.plist parser safari_cookies (v1.0) : Safari Cookies.plist parser safari_bm (v1.0.1) : Safari Bookmarks.plist parser safari_downloads (v3.0) : Safari Downloads.plist parser pref_parser (v0.9.1) : general purpose plist parser safari_icon.pl(v1.0.1) : Safari v3.x icon.db parser (PERL) safari_icon (v1.0) : Safari v2.x icon .cache file parser [OSX only] safari_wincache.pl(1.0.1): Safari v3.x (Windows) cache.db parser (PERL) safari_cache(v1.0) : Safari .cache file parser [OSX only] Installing: ============ Safari Forensic Tools is being distributed in both binary and source code formats. The binary version: ------------------- The binary version is a statically linked binary built on Linux and should run on any x86 Linux distribution. To install the binary version, simply unpack the tarball and run "make install" to install it in in the /usr/local/sft/Tools directory. You can edit the top level GNUmakefile and change the GNUSTEP_INSTALLATION_DIR to install in another location. You could also just copy the binaries (located in the obj/ subdirectory of each tool directory to your desired location. Compile the source code (Linux): -------------------------------- - Install GNUstep (See: http://www.gnustep.org) - Initialize the GNUstep environment using the following command: (Assuming GNUstep is installed in /usr/lib/GNUstep) ". /usr/lib/GNUstep/System/Library/Makefiles/GNUstep.sh" - Unpack the source code and compile: tar xzvf sft-1.1.1.tar.gz cd sft-1.1.1 make make install The "make install" step will install the SFT binaries in the /usr/local/sft/Tools directory. If you would like to install it in a different directory, simply edit the top level GNUMakefile and modify the GNUSTEP_INSTALLATION_DIR variable. Note that GNUStep adds the "Tools" sub-directory onto the specified install directory. To statically compile the binary substitute the "make" command with: make shared=no Compile the source code (OSX): ------------------------------ - Unpack the source code and compile: tar xzvf sft-1.1.1.tar.gz cd sft-1.1.1 make -f Makefile.OSX make -f Makefile.OSX install The default install location is /usr/local/sft . To change the location run the command: make -f Makefile.OSX install INSTALL_DIR=/path/to/alt/location CHANGES: ======== v1.1.1 - Fixed error in safari_wincache.pl and safari_icon.pl on Windows - Fixed Windows compile errors in safari_bm and pref_parser v1.1 - Added safari_wincache.pl, safari_cache, safari_icon, safari_icon.pl - Updated SFT.README, Makefile.OSX, GNUmakefile v1.0 - Initial public release of the tool bundle LICENSE: ======== Safari Forensic Tools(Copyright 2007 Jake Cunningham) is distributed under the GNU GPL v2. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. #----------------------------------------------------------------------------\