iOS Data Analysis and Recovery - Practical Mobile Forensics - page 162

Property lists
A property list, commonly referred to as a plist, is a structured data format used to store, or-
ganize, and access various data types of data on an iOS device as well as a Mac OS X
device. Plists are binary-formatted files and can be viewed using a Property List Editor ,
which is capable of reading or converting the binary format to ASCII.
Plist files may or may not have a .plist file extension. To access the data stored in these
files, you need a tool that can read them. Some of the good free tools include:
• Plist Editor for Windows, which can be downloaded from ht-
tp://www.icopybot.com/plist-editor.htm
• The plutil command-line utility on Mac OS X
You can also view the plist files using XCode. Mac OS X includes the plutil command-line
utility by default. The command-line utility can easily convert the binary formatted files in-
to human readable files.
The following example displays the Safari browser History.plist file:
$sudo plutil -convert xml1 History.plist -o -
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>WebHistoryDates</key>
<array>
<dict>
<key></key>
<string>http://www.securitylearn.net/</string>
<key>D</key>
<array>
<integer>1</integer>
</array>
<key>lastVisitedDate</key>
<string>411576251.8</string>
<key>title</key>
<string>securitylearn/</string>