Safari Bookmarks

Overview

Safari stores bookmarks and the Reading List together in a single binary property list file, Bookmarks.plist. This artifact reveals sites the user has explicitly saved for future reference, how they organise their bookmarks into folders, and articles they have marked for later reading. Unlike browsing history (which captures all visits), bookmarks represent deliberate user intent to preserve access to specific resources.

The bookmark tree structure also reveals the user's Bookmarks Bar content -- the sites they keep most accessible -- which can provide insight into frequently used tools, services, and interests.

File Locations

File Format

Bookmarks.plist is a binary property list containing a hierarchical tree structure. Each node is either a folder (WebBookmarkTypeList) or a bookmark (WebBookmarkTypeLeaf).

Tree Structure

Root (Dictionary)
  WebBookmarkType: "WebBookmarkTypeList"
  WebBookmarkUUID: "<UUID>"
  Title: ""
  Children (Array)
    [0] BookmarksBar (WebBookmarkTypeList)
      Title: "BookmarksBar"
      Children (Array)
        [0] Bookmark (WebBookmarkTypeLeaf)
        [1] Subfolder (WebBookmarkTypeList)
          Children (Array)
            ...
    [1] BookmarksMenu (WebBookmarkTypeList)
      Title: "BookmarksMenu"
      Children (Array)
        ...
    [2] Reading List (WebBookmarkTypeList)
      Title: "com.apple.ReadingList"
      Children (Array)
        [0] Reading List Item (WebBookmarkTypeLeaf)
          ReadingList (Dictionary)
            DateAdded: <date>
            DateLastFetched: <date>
            PreviewText: "..."

Node Types

Bookmark Entry Fields

Reading List Metadata

Reading List items are bookmarks within the com.apple.ReadingList special folder, with an additional ReadingList dictionary:

Special Folder Names

Key Fields for Analysis

• URLString: The bookmarked URL. Reveals sites of interest to the user.
• Title / URIDictionary.title: The display title. The URIDictionary.title value reflects the page title at the time the bookmark was created and may differ from the folder-level Title if the user renamed the bookmark.
• Folder hierarchy: The folder path (e.g., BookmarksBar/Work/Research) reveals how the user categorises and organises sites. Folder names created by the user can be highly informative.
• WebBookmarkUUID: Unique identifier for forensic correlation and tracking changes across backup snapshots.
• Reading List DateAdded: When the user saved an article. This provides a precise timestamp for the user expressing interest in specific content.
• Reading List PreviewText: A content snippet that persists even if the original page is taken down.

Timestamps

Timestamps in the Reading List entries (DateAdded, DateLastFetched) are standard property list <date> values in ISO 8601 format. Standard bookmarks (non-Reading List) do not reliably include creation timestamps in all Safari versions.

Analysis Notes

• User interests: Bookmark folders and their organisation reveal what topics the user considers important enough to save. Work-related, research, and hobby folders can provide investigative context.
• Bookmarks Bar analysis: The Bookmarks Bar typically contains the user's most-accessed resources -- internal tools, email, banking, social media. This is a high-value section for understanding daily activity.
• Reading List as intent: Unlike automatic history, Reading List items represent explicit intent to read specific content. The DateAdded timestamp marks the moment of interest.
• Reading List preview text: The PreviewText field preserves article content even if the original page is deleted or modified. This can be relevant when the source content is no longer available.
• Missing bookmarks: If Bookmarks.plist exists but is unusually small or empty, bookmarks may have been deleted or the file may have been replaced.
• iCloud sync: Bookmarks may be synced via iCloud across devices. The local Bookmarks.plist reflects the last known sync state. Some bookmarks may have originated on other Apple devices.
• Recursive structure: The tree can be nested arbitrarily deep. Forensic tools must recursively traverse the Children arrays to find all bookmarks.

Version Differences

The Bookmarks.plist structure has remained stable across Safari versions from Safari 10 through Safari 17. The three special folders (BookmarksBar, BookmarksMenu, com.apple.ReadingList) are consistently present.

Minor additions in newer versions may include additional metadata keys within bookmark entries, but the core structure is unchanged.

Tool Support

macfor

The browser.safari plugin recursively parses Bookmarks.plist and emits two record types:

• browser_bookmark: For standard bookmarks, with fields url, title, folder_path (e.g., BookmarksBar/Work/Research), uuid, and source_file.
• reading_list_item: For Reading List entries, with additional fields preview_text, date_added, and date_last_fetched.

The raw plist file is also preserved in the evidence container.

Manual Analysis

# Convert to XML for inspection
plutil -convert xml1 -o - ~/Library/Safari/Bookmarks.plist

# View with Python
python3 -c "
import plistlib

def walk(node, path=''):
    bm_type = node.get('WebBookmarkType', '')
    title = node.get('Title', '')
    if bm_type == 'WebBookmarkTypeLeaf':
        url = node.get('URLString', '')
        uri_title = node.get('URIDictionary', {}).get('title', title)
        rl = node.get('ReadingList')
        if rl:
            print(f'[ReadingList] {uri_title}')
            print(f'  URL: {url}')
            print(f'  Added: {rl.get(\"DateAdded\", \"N/A\")}')
        else:
            print(f'[{path}] {uri_title}')
            print(f'  URL: {url}')
    elif bm_type == 'WebBookmarkTypeList':
        new_path = f'{path}/{title}' if path else title
        for child in node.get('Children', []):
            walk(child, new_path)

with open('Bookmarks.plist', 'rb') as f:
    walk(plistlib.load(f))
"

References

• Apple Property List Documentation
• SANS FOR518: Mac and iOS Forensic Analysis