Safari History Database Tags Can Reveal What Users Were Browsing on macOS
Safari History.db topic tags can reveal macOS browsing themes even after some history records are removed.
Safari's SQLite History.db on macOS can store automatically generated topic tags for some webpages, alongside visited URLs, titles, timestamps, and visit counts. The history_tags and history_items_to_tags tables link a short title and identifier, sometimes a Wikidata entity beginning with Q, to a history item. Tags are contextual rather than proof of intent, and entries with an item count of zero may persist after related history relationships are deleted. The mac_apt forensic framework can parse this data to help DFIR teams reconstruct browsing themes and timelines.
36