#----------------------------------------------------------------------------\
				safari_icon v1.0

			http://jafat.sourceforge.net
			Copyright 2007 - Jake Cunningham

#----------------------------------------------------------------------------\

Background:
===========

The Safari v3.0 web browser stores a cache of the "favicon.ico" files and 
related metadata from each web site visited to the files:

On MS Windows:
C:\Documents and Settings\<USER>\Local Settings\Application Data\Apple Computer\Safari\icon.db

On MacOSX:
~<useraname>/Library/Safari/Icons/icon.db


This PERL program parses the icon.db file and presents its contents 
in TAB delimited or HTML format. 

The icon.db file is a SQLite v3 database file. More information on SQLite
can be found here: http://www.sqlite.org


Installing:
============

This PERL script requires the DBD::SQLite perl module.

This script has been tested on:

Linux (Perl 5.8.8)
OSX
Windows (Active State Perl 5.8.8 Build 822)


Usage:
======

To output the icon cache metadata to STDOUT in TAB delimited format: 
(cache index , URL of icon, date/time icon was cached, URL of page visited)

$ safari_icon.pl -f icon.db


To extract the icon (image) data to files and output the icon cache metadata 
to an index.html file:

$ safari_icon.pl -f icon.db -s ./icon_output

With this above command line, the script will create a directory named 
"icon_output". It will then extract the icon image data and write it to
the directory. It will also write a HTML file named index.html 
which contains a table of the metadata associated with each entry and 
a link to the extracted favicon.ico image file.
The investigator can then open the index.html file in a web browser, see
the metadata for the icon, and view the icon.

By default the timestamp indicating when the icon was written to the database
is in the localtime of the examining machine. To convert the timestamp to GMT, 
add the "-g" command line option to any of the command examples above.



Changes:
========
v1.0.1 - Fixed error message when using on Windows.
v1.0 - Initial public release (included with SFT 1.1)


LICENSE:
========

safari_icon.pl (Copyright 2007 Jake Cunningham) is distributed under 
the GNU GPL v2.

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

#----------------------------------------------------------------------------\