Safari History Tags Can Reveal Browsing Themes

Safari History.db topic tags, sometimes Wikidata-linked, can reveal macOS browsing themes even after some history is deleted.

Safari’s History.db on macOS can retain automatically generated topic tags that help investigators infer browsing themes even after some history records are removed. The database, at ~/Library/Safari/History.db, links short titles and identifiers to history items through history_tags and history_items_to_tags, alongside URLs, titles, timestamps, and visit counts. One report says some identifiers are Wikidata entities beginning with Q, while the other says identifiers typically start with Q and map to Wikidata concepts; both agree not every page is tagged. Tags are contextual rather than proof of intent, and a label such as “APT” can mean the Advanced Package Tool (Q230724) rather than an intrusion. Residual tags with a zero item count may survive deletion of related history links, and the behavior has been observed since at least 2021. The mac_apt framework parses these records; Cocoa timestamps must be converted by adding 978307200 seconds.

• Safari’s SQLite History.db, at ~/Library/Safari/History.db, stores automatically generated topic tags for some visited pages along with URLs, titles, timestamps, and visit counts.
• Tags are stored in history_tags and history_items_to_tags; identifiers sometimes or typically begin with Q and map to Wikidata entities rather than exact keywords.
• Sources disagree slightly: one says some identifiers are Wikidata entities, the other that they typically start with Q. Not every page is tagged, and the behavior has been observed since at least 2021.
• Tags are contextual, not proof of intent; labels can mislead, such as “APT” referring to the Advanced Package Tool (Q230724) rather than an intrusion.
• Orphaned tags with an item count of zero can remain after related history relationships are deleted.
• mac_apt can parse Safari history tags for macOS DFIR triage and disk images. Cocoa timestamps require adding 978307200 seconds to convert to Unix time.