iOS Data Analysis and Recovery - Practical Mobile Forensics - page 158

zmodificationdate, ztitle, zsummary, zcontent
FROM znote, znotebody
WHERE znotebody.z_pk=znote.z_pk
ORDER BY znote.z_pk ASC;
sqlite>.exit
Safari bookmarks
The Safari browser used on an Apple device allows users to bookmark their favorite web-
sites. The bookmarks database is a HomeDomain file and can be found at /private/
var/mobile/Library/Safari/Bookmarks.db .
You can run the following commands to view the bookmarks stored in the database:
$sqlite3 bookmarks.db
SQLite version 3.7.12 2012-04-03 19:43:07
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite>.headers on
sqlite> select title, url from bookmarks;
sqlite>.exit
The Safari web caches
The Safari browser stores the recently downloaded and cached data in a database. The
database is a HomeDomain file and can be found at /private/var/mobile/
Library/Caches/com.apple.mobilesafari/Cache.db . The file contains
cached URLs and the web server's responses along with the timestamps.
The web application cache
Offline data cached by web applications, such as images, HTML, JavaScript, style sheets,
and more are stored in a database. The database is a HomeDomain file and can be found
at /private/var/mobile/Library/Caches/com.apple.WebAppCache/
ApplicationCache.db .
The WebKit storage
Safari stores information from various sites in the WebKit database located in the
/private/var/mobile/Library/WebKit/LocalStorage/ directory. The