Dump Safari Preferences
Overview
Section titled “Overview”Evidence: Dump Safari Preferences
Description: Dump Safari Preferences
Category: Applications
Platform: macos
Short Name: sprefs
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Browser preference files store sign-in, sync, and per-profile settings. During an infostealer investigation they show whether a browser profile was signed in, whether sync was enabled, and which account settings the browser stored.
Safari stores these settings in a preferences plist.
Data Collected
Section titled “Data Collected”The collector copies the preference files into the acquired evidence. It does not parse them into Investigation Hub tables.
Collection Method
Section titled “Collection Method”The collector copies these files when they exist:
/Users/*/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist/Users/*/Library/Preferences/com.apple.Safari.plist
Forensic Value
Section titled “Forensic Value”The copied files let an analyst inspect sync status, signed-in accounts, and related browser settings from the evidence itself.
Preference files can contain account identifiers and sync settings. Handle them with the same access controls as other browser evidence.