Uncertain whether the database contained all of the searches conducted with both regular and private browsers, the cookies were then inspected. Cookies are small files that contain some identifying data about a user when they visit a website.

Upon inspection of the cookies that are tracked by this particular application, we found evidence that more websites were visited that weren’t contained in the initial review of the histories table. Cookies were recorded for all of the sites that were visited while in private mode. While not all cookies contain usable information, this particular cookie proved that the user visited the domain wtop.com to view an article about cherry blossoms on 3/15/17.

While your forensic utilities can parse the data from Safari Cookies.binarycookies like the ones you are viewing above, there are free scripts as well that provide similar functionality. A robust cookie parser that allows for the export of multiple binary cookies into a single directory for parsing is made available by SANS instructor Mari DeGrazia. The tool also includes support for:

•  Parsing the Google Analytic values from the Cookies (umta, utmb, utmz)

•  Output option forTLN format

Reference:

[1] https://github.com/mdegrazia/Safari-Binary-Cookie-parser