Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Safari Cache Evidence Processor Module

This is a self-installing EnCase Evidence Processor module that parses Safari cache content from the following location -

~/Library/Caches/com.apple.Safari

The module supports parsing data from the Cache.db SQLite database file and associated fsCachedData folder; also WebKit cache content in the WebKitCache folder.

First install the module by dragging and dropping it onto EnCase. The module can then be invoked by selecting it under the Modules folder of the EnCase Evidence Processor dialog box. The examiner should ensure that signature analysis is checked in order to identify the content of each cached-resource (cached resources do not have file-extensions).

Please note that only Webkit V4 and V12 are supported. Please contact the author if there is an urgent need to parse other versions.

Download Now



Version: 6.0
Tested with:
EnCase Forensic 8.07
Developer: Simon Key
Category: Artifact

6321 DOWNLOADS

YOU MAY ALSO LIKE

Artifact

WebCacheV01.dat Internet History Decoder

This EnScript parses Internet history data from WebCacheV01.dat files. This includes the Internet history data generated by the Microsoft Internet Explorer and Edge web-browser programs.
By Simon Key
9970 Downloads
App
Artifact

Cortana Search Decoder

Decodes the search terms stored in IndexedDB.edb files used by the Microsoft Windows Cortana search function.
By Simon Key
7637 Downloads
App
Artifact

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.
By Simon Key
381 Downloads
App
Artifact

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.
By Simon Key
226 Downloads
App