Safari Cache Evidence Processor Module
This is a self-installing EnCase Evidence Processor module that parses Safari cache content from the following location -
The module supports parsing data from the Cache.db SQLite database file and associated fsCachedData folder; also WebKit cache content in the WebKitCache folder.
First install the module by dragging and dropping it onto EnCase. The module can then be invoked by selecting it under the Modules folder of the EnCase Evidence Processor dialog box. The examiner should ensure that signature analysis is checked in order to identify the content of each cached-resource (cached resources do not have file-extensions).
Please note that only Webkit V4 and V12 are supported. Please contact the author if there is an urgent need to parse other versions.
YOU MAY ALSO LIKE