Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Safari Cache Evidence Processor Module

This is a self-installing EnCase Evidence Processor module that parses Safari cache content from the following location -

~/Library/Caches/com.apple.Safari

The module supports parsing data from the Cache.db SQLite database file and associated fsCachedData folder; also WebKit cache content in the WebKitCache folder.

First install the module by dragging and dropping it onto EnCase. The module can then be invoked by selecting it under the Modules folder of the EnCase Evidence Processor dialog box. The examiner should ensure that signature analysis is checked in order to identify the content of each cached-resource (cached resources do not have file-extensions).

Please note that only Webkit V4 and V12 are supported. Please contact the author if there is an urgent need to parse other versions.

Download Now



Version: 6.0
Tested with:
EnCase Forensic 8.07
Developer: Simon Key
Category: Artifact

4990 DOWNLOADS

YOU MAY ALSO LIKE

Artifact

WebCacheV01.dat Internet History Decoder

This EnScript parses Internet history data from WebCacheV01.dat files. This includes the Internet history data generated by the Microsoft Internet Explorer and Edge web-browser programs.
By Simon Key
7450 Downloads
App
Artifact

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.
By Simon Key
141 Downloads
App
Artifact

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.
By Simon Key
98 Downloads
App
Artifact

Windows Search Application Data Parser

This script parses data maintained by the Windows search function relating to recently-used applications and documents
By Simon Key
84 Downloads
App