Page 1

SAFARI & BROWSERARTEFACTS · A GUIDE FOR UK LAWYERS Safari and Browser Artefacts on macOS History, Tabs and the iCloud Sync That Outlives a Cleared Browser COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ICLOUD-SYNCED HISTORY RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a cleared browser is not a clean one 03 Where Safari keeps its artefacts 04 Deliberate versus automatic activity 05 The iCloud sync that outlives clearing 06 Third-party browsers, attribution and honest limits 07 Deployment: proving web activity and intent 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: Safari records web activity in structured local artefacts and syncs much of it through

§ 02 · FIRST PRINCIPLES The problem in plain English: a cleared browser is not a clean one

§ 03 · WHERESAFARIKEEPSITSARTEFACTS Where Safari keeps its artefacts HISTORY DOWNLOADS TABS / SESSIONS CACHE / COOKIES ICLOUD SYNC