browserforensics
← Back to all articles

Safari bookmarks forensics (Bookmarks.plist)

2026-06-21 · 3 min

Chrome keeps bookmarks as plain JSON; Safari does not. It writes a single Apple binary property list, so a text editor shows you garbage and most JSON tooling stalls. Underneath the binary framing is a clean tree of folders and bookmarks — plus the Reading List, which carries its own timestamps and is easy to overlook.

The file

Safari stores bookmarks in one file in the user's Library:

~/Library/Safari/Bookmarks.plist

It is a binary plist, not XML — the first eight bytes are the magic bplist00. You cannot read it with a text editor and you cannot feed it straight to a JSON parser. You need a binary-plist decoder first; once decoded, what comes out is an ordinary nested dictionary tree. See where browsers store their artifacts for the rest of the Safari profile layout.

The plist tree

Every node in the tree is keyed by a WebBookmarkType. Three types matter:

  • WebBookmarkTypeLeaf — an actual bookmark. The URL is in URLString; the display title is in URIDictionary.title.
  • WebBookmarkTypeList — a folder. It has a Title and a Children array holding more nodes, which nest arbitrarily deep.
  • WebBookmarkTypeProxy — a special placeholder, such as the History menu entry. These are structural, not user bookmarks, and are usually noise for triage.

So you walk the tree recursively: at each List push the folder name, recurse into Children, and emit a row for each Leaf you reach with its folder path, title, and URL.

The Reading List

The Reading List lives in its own List inside the same file — pages the user saved to read later. Its leaf entries are still WebBookmarkTypeLeaf nodes, but they carry an extra ReadingList dictionary with metadata you do not get on ordinary bookmarks:

  • DateAdded — when the page was saved.
  • DateLastViewed — when it was last opened from the list (absent if never opened).
  • PreviewText — a snippet of the page body captured at save time.

That PreviewText is quietly valuable: it can preserve a chunk of page content that no longer exists online, captured at a known moment.

What to extract

  • Sustained interest. A bookmark is a deliberate save. Like Chrome's, Safari's bookmarks persist through history clearing — a user who wipes History.db rarely prunes Bookmarks.plist, so it outlives the cleared history as evidence.
  • Accounts and services. Bookmarked logins, dashboards, and webmail map the accounts the user actually relied on.
  • Internal and admin URLs. Bookmarks to intranet hosts and admin consoles reveal access to systems that may never surface in external logs.
  • Intent with timestamps. The Reading List shows pages the user set aside for later — intent — and DateAdded / DateLastViewed anchor that to a timeline.

Cross-reference bookmarked and Reading List URLs against the history file: a saved page with no surviving visits is a strong sign history was cleared while the bookmark was left behind.

Working with the tool

BrowserForensics decodes the binary plist in the browser — it ships its own bplist parser, so you do not need plutil or a Mac to read the file — and flattens the tree into a flat folder / title / url table. Reading List entries appear alongside ordinary bookmarks, so the whole file reads as one list instead of nested folders you click through. Nothing leaves the machine.

Further reading