Page 1
SAFARI & BROWSERARTEFACTS · A GUIDE FOR UK LAWYERS Safari and Browser Artefacts on macOS History, Tabs and the iCloud Sync That Outlives a Cleared Browser COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ICLOUD-SYNCED HISTORY RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a cleared browser is not a clean one 03 Where Safari keeps its artefacts 04 Deliberate versus automatic activity 05 The iCloud sync that outlives clearing 06 Third-party browsers, attribution and honest limits 07 Deployment: proving web activity and intent 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: Safari records web activity in structured local artefacts and syncs much of it through
§ 02 · FIRST PRINCIPLES The problem in plain English: a cleared browser is not a clean one
§ 03 · WHERESAFARIKEEPSITSARTEFACTS Where Safari keeps its artefacts HISTORY DOWNLOADS TABS / SESSIONS CACHE / COOKIES ICLOUD SYNC
Page 2
§ 04 · DELIBERATEVERSUSAUTOMATIC Deliberate versus automatic activity
§ 05 · THEICLOUDSYNC The iCloud sync that outlives clearing
§ 06 · THIRD - PARTYBROWSERSANDHONESTLIMITS Third-party browsers, attribution and honest limits
§ 07 · DEPLOYMENT Deployment: proving web activity and intent
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE I CLOUD MAC PAIRED THIRD-PARTY NETWORK DELETED / SAFARI IPHONE / IPAD BROWSER LOGS CLEARED
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECLEAREDMACANDTHEIPHONETHATREMEMBERED EXAMPLE2 · THEURLTHATWASNOTANINTENTION EXAMPLE3 · THEACTIVITYSPREADACROSSTHREEBROWSERS
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Safari and browser checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The history was cleared. Is the browsing gone? If a website is in the history, does that mean they chose to visit it? Should we look at browsers other than Safari? What about private or incognito browsing? Can browsing prove who was at the keyboard? How urgent is preserving the Mac?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Safari And Browser Artefacts On MacOS, Computer Forensics Lab, https://e-discovery.uk/library/safari-and-browser-artefacts-on-macos/pdf.