Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Safari Evidence Processor Module

This script, which was previously called the Safari Cache Evidence Processor Module, is a self-installing Evidence Processor module that parses macOS Safari web-browser data.

It currently supports parsing legacy cache content indexed by Cache.db files, WebKit cache content from WebKitCache folders, Internet history indexed by History.db files, cloud-tab data indexed by CloudTabs.db files, top-site data stored in TopSites.plist files, download information stored in Downloads.plist files, and recent tabs information stored in LastSession.plist and RecentlyClosedTabs.plist files.

Webkit cache versions 4, 12, 13 and 14 are supported. Please contact the author if there is an urgent need to parse other versions.

The module is installed by dragging and dropping it onto EnCase. It can then be invoked by selecting it under the Modules folder of the EnCase Evidence Processor dialog box. The examiner should ensure that file-signature analysis is checked in order to identify the content of each cached-resource (cached resources do not have file-extensions).

Additional important information is contained in the module installer and EnCase Evidence Processor dialog box.

Download Now



Version: 8.7
Tested with:
EnCase Forensic 8.09
Developer: Simon Key
Category: Artifact

5511 DOWNLOADS

YOU MAY ALSO LIKE

Artifact

WebCacheV01.dat Internet History Decoder

This EnScript parses Internet history data from WebCacheV01.dat files. This includes the Internet history data generated by the Microsoft Internet Explorer and Edge web-browser programs.
By Simon Key
9092 Downloads
App
Artifact

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.
By Simon Key
745 Downloads
App
Artifact

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.
By Simon Key
556 Downloads
App
Artifact

Windows Search Application Data Parser

This script parses data maintained by the Windows search function relating to recently-used applications and documents
By Simon Key
454 Downloads
App