Safari history file locations
2026-05-19 · 2 min
Modern Safari sandboxes more of its data than it used to. The classic
~/Library/Safari still exists, but cookies and preferences moved into
the com.apple.Safari container under ~/Library/Containers/. If you
only acquire ~/Library/Safari, you will miss the cookies and a chunk of
configuration.
Paths (macOS)
/Users/<user>/Library/Safari/
/Users/<user>/Library/Containers/com.apple.Safari/Data/Library/Cookies/
/Users/<user>/Library/Containers/com.apple.Safari/Data/Library/Preferences/
/Users/<user>/Library/Containers/com.apple.Safari/Data/Library/Safari/
On iOS extractions from a backup, Safari history lives under
HomeDomain/Library/Safari/.
What each file holds
| File | Format | Contents |
|---|---|---|
History.db | SQLite | history_items (URL + visit_count), history_visits (per-visit rows) |
History.db-wal, History.db-shm | SQLite WAL | Recent commits — collect or you miss them |
Bookmarks.plist | bplist | Bookmarks tree, reading list |
Downloads.plist | bplist | Download records (until cleared) |
LastSession.plist | bplist | Windows / tabs at last quit |
RecentlyClosedTabs.plist | bplist | Recently closed |
Cookies.binarycookies | binarycookies | Apple's bespoke cookie format |
com.apple.Safari.plist | bplist | Settings, recent searches |
favicons.db | SQLite | Favicon metadata + image blobs |
WebpageIcons.db | SQLite | Older favicon database (pre-Big Sur) |
TopSites.plist | bplist | Pinned/top sites |
history_visits.visit_time is the per-visit timestamp; history_items.last_visit_time
mirrors the maximum. Use the visits table for timeline work, not the
aggregated item.
Timestamps
Safari uses Mac absolute time — seconds (often fractional) since 2001-01-01 UTC. Convert with:
unix_seconds = mac_absolute + 978307200
See browser timestamp formats for the full reference.
Cookies format quick reference
Cookies.binarycookies starts with cook, then a count, then per-page
offsets pointing to cookie records. Each record has a fixed 56-byte
header (flags, expiry, creation, four string offsets) followed by name,
value, path, domain strings. Both timestamps are Mac absolute time as
float64.
Acquisition notes
- Full Disk Access matters. Without it, a user-mode tool cannot read Safari's container. Image the volume or use a FileVault-aware acquisition.
- The
Reading Listitems live insideBookmarks.plistunder a specific parent UUID. Useful when a suspect saved a page to read later — much stronger intent than a casual visit. - Cross-correlate with iCloud-synced tabs from other devices if you have the iCloud account in scope.