Safari History Database Tags Can Reveal Users’ Browsing Themes in Forensic Investigations
Safari History.db stores Wikidata-linked topic tags that can reveal browsing themes in macOS investigations.
Safari’s History.db, at ~/Library/Safari/History.db, can attach automatically generated topic tags to visited pages through the history_tags and history_items_to_tags tables. Tag identifiers typically start with “Q” and map to Wikidata concepts; not every page is tagged, and the behavior has been observed since at least 2021. Investigators must convert Cocoa timestamps by adding 978307200 seconds, and labels can mislead—for example “APT” may mean the Advanced Package Tool (Q230724) rather than an intrusion. Residual tags can remain after related history records are deleted, and mac_apt now parses them.
36