JAFAT: Archive of Forensic Analysis Tools
Open Source tools to assist with Computer Forensic Investigations


Safari Forensic Tools (SFT) FAQ


Compiling/Installing

I want to compile SFT on Linux. What do I need?

A: Before you can compile SFT on Linux, you will need to install the GNUStep framework. Many Linux distributions have GNUStep packages that you can install from the distributions' package archives.

I don't want to install GNUStep on Linux. Do I have any other options?

A: Yes. Install the statically compiled version of SFT for Linux. See the SFT project page for more info.

Do I need GNUStep to compile SFT on MacOSX?

A: No. OSX has the Cocoa framework to build SFT.

I want to compile SFT on MacOSX. What do I need?

A: SFT will compile on OSX. Depending on your system's configuration, you may need to install the Developer Tools from your OSX installation media.

Do you have SFT pre-compiled for OSX?

A: Not yet. I'm working on a Universal Binary for OSX.

Do you have SFT pre-compiled for MS Windows?

A: Yes. SFT version 1.1.1 is the first version to be compiled on MS Windows. See the download site for the Windows binary version.

What's up with all the compiler warnings about "multiple methods named -writeData" when I compile SFT?

A: They're just compiler warnings. The tools will compile and the warnings won't affect the operation of the tools.

Using the tools


I tried to run safari_wincache.pl and/or safari_icon.pl and got the error message:

A: These programs require the DBI::SQLite PERL module from CPAN.

Please clarify what OS the tools run on and files they parse.

A: See the table below. The "Runs on" column describes which OS you can compile and run the tools from. The "Purpose" and "Data files from:" columns describes the files the tools will parse.

Tool Purpose Runs on: Data Files from:
safari_hist1.1 Safari Histroy.plist parser Linux, OSX, Windows OSX (Safari 2.x,3.x), Windows (Safari 3.x)
safari_download-3.0 Safari Downloads.plist file parser Linux, OSX, Windows OSX (Safari 2.x,3.x), Windows (Safari 3.x)
safari_cookies-1.0 Safari Cookies.plist file parser Linux, OSX, Windows OSX (Safari 2.x,3.x), Windows (Safari 3.x)
safari_bm-1.0.1 Safari Bookmarks.plist file parser Linux, OSX, Windows OSX (Safari 2.x,3.x), Windows (Safari 3.x)
pref_parser-0.9 General purpose .plist file parser Linux, OSX, Windows OSX (Safari 2.x,3.x), Windows (Safari 3.x)
safari_cache Safari cached data parser OSX only OSX (Safari 2.x,3.x)
safari_wincache.pl Safari cache.db cached data parser Linux, OSX, Windows Windows (Safari 3.x)
safari_icon_osx Safari cached icon parser OSX only OSX (Safari 2.x)
safari_icon.pl Safari icon.db cached icon parser Linux, OSX, Windows OSX (Safari 3.x), Windows (Safari 3.x)

Can you make the output from safari_cookies TAB delimited?

A: Maybe in the next release.

When I run the tools against XLM data files, I get this message and then the output.
don't know how to load entity 'http://www.apple.com/DTDs/PropertyList-1.0.dtd' id '-//Apple//DTD PLIST 1.0//EN' .:3: validity error : Validation failed: no DTD found !

A: This error won't affect the operation of the tools.

Safari Forensics

Where are the Safari related files located on OSX?

A: See the Documents portion of the SFT website

Sourceforge.net Logo©2007 Jake Cunningham - jakec76@users.sourceforge.net