The following files are key files of interest for iOS Safari:
• /mobile/Library/Safari/CloudTabs.db - will only exist if icloud sync is enabled for Safari
• /mobile/Library/Safari/Bookmarks.db
• /mobile/Library/Safari/SafariTabs.db
• /mobile/Library/Safari/History.db
• /mobile/Containers/Data/Application/<GUID>/Library/Safari/Thumbnails/
• /mobile/Containers/Data/Application/<GUID>/Library/Favicons/Favicons/
• /mobile/Containers/Data/Application/<GUID>/Caches/Cache.db
• /mobile/Containers/Data/Application/<GUID>/Library/Preferences/com.apple.mobilesafari.plist
While most of the files are self-explanatory, here are some descriptions that may help you in your investigations. The database /mobile/Library/Safari/SafariTabs.db
SELECT
bookmarks.id as "ID",
bookmarks.parent as "Parent",
bookmarks.title as "Title",
bookmarks.url as "URL",
windows_tab_groups.active_tab_id as "Active Tab ID",
--Active Tab ID is the last active tab or tab being viewed for each group
bookmarks.num_children as "# of Children",
bookmarks.order_index as "Order Index"
from bookmarks
left
join bookmark_title_words on bookmark_title_words.bookmark_id=bookmarks.id
left join windows_tab_groups on
windows_tab_groups.tab_group_id=bookmarks.id
The history database is parsed by most commercial tool. The path is /private/var/mobile/Library/Safari/History.db. This database tracks the searches made using the Safari URL bar in the regular browsing tabs (Private browsing searches are not recorded here).
select
history_visits.id,
datetime(history_visits.visit_time + 978307200,'unixepoch') as "Visit Time",
history_visits.title as "Title",
CASE
when history_visits.load_successful = 1 then "Yes"
when history_visits.load_successful = 0 then "No"
end as "Load Successful",
history_items.url as "URL",
history_items.domain_expansion as "Domain Expansion",
history_items.visit_count as "Visit Count"
from history_visits
left join history_items on history_items.id=history_visits.history_item