Safari cookie times...
 
Notifications
Clear all

Safari cookie timestamps?

6 Posts
5 Users
0 Likes
618 Views
turtlecove
(@turtlecove)
Posts: 34
Eminent Member
Topic starter
 

I am examining a Safari cookies.plist file from a Mac. Some of the cookies have dates that have integer and fractional parts. These dates correctly evaluate to dates in the 2006-2009 range. Some of the cookies, unfortunately the ones I need, have only an integer part and don't evaluate to any sensible date. Does anyone know how they are encoded?

Note Safari cookies 'Created' key is SUPPOSED to be a CFAbsoluteTime, which means the number of seconds since Jan 1st, 2001. To convert this in Excel, for example, use =CreatedTime/(60*60*24)+DATE(2001,1,1)
Note2 I am working on Windows so I cannot use Mac-only tools.

Here is a relevant clip

<dict>
<key>Created</key>
<real>260192144.15709901</real>
<key>Domain</key>
<string>.photobucket.com</string>
<key>Expires</key>
<date>2012-02-29T235959Z</date>
<key>Name</key>
<string>XYZ</string>
<key>Path</key>
<string>/</string>
<key>Value</key>
<string>+1smIeJc4+314+4</string>
</dict>
<dict>
<key>Created</key>
<real>299546270</real>
<key>Domain</key>
<string>.incriminatingsite.com</string>
<key>Expires</key>
<date>2010-07-06T173017Z</date>
<key>Name</key>
<string>aHSM</string>
<key>Path</key>
<string>/</string>
<key>Value</key>
<string>12S888882568888B</string>
</dict>

 
Posted : 22/12/2009 10:35 pm
(@rich2005)
Posts: 535
Honorable Member
 

The example you give decodes to a valid time as far as I can see, although in the future. System clock wrong from the originating system?

 
Posted : 23/12/2009 3:47 pm
(@emeeuk)
Posts: 16
Active Member
 

IIRC the fractional side of the time value makes no difference when converting the date/time in excel ( you can leave it out and get the same value).

Do you have any URL history/cache records showing the same discrepancy of 'incrimatinsite.com's date and time?

 
Posted : 23/12/2009 6:07 pm
(@woany)
Posts: 28
Eminent Member
 

Have you tried the SFT (Safari Forensic Tools)?

They are written in objective C (for MacOs) and therefore will should correctly load the XML and binary formats for the Safari web browser. There is a window binary download that includes the objective C runtime etc.

http//jafat.sourceforge.net/files.html

or if you have perl installed then you could try http//scw.us/iPhone/plutil.

I have used both and they seem to work ok.

 
Posted : 23/12/2009 7:07 pm
(@indur)
Posts: 67
Trusted Member
 

As far as I know, they are always CFAbsoluteTime.

 
Posted : 29/12/2009 8:55 pm
turtlecove
(@turtlecove)
Posts: 34
Eminent Member
Topic starter
 

No luck.
plutil converts it to a binary plist, but SFT errors on both the XML and the binary

L\Library\Software\Mac tools\SFT-1.1.1-WIN>safari_cookies.exe "L\Cases\xyz\extracted files\xyz-webhistory\Cookies[1420570].plist"

2010-01-07 143859.495 safari_cookies.exe[4036] File NSUserDefaults.m 562. In
[NSUserDefaults +standardUserDefaults] Improper installation No language locale
found
2010-01-07 143859.651 safari_cookies.exe[4036] File NSArray.m 732. In [GSPlac
eholderArray -initWithContentsOfFile] Contents of file 'L\Cases\xyz\extracted files\xyz-webhistory\Cookies[1420570].plist' does not contain an array

ERROR Couldn't parse "L\Cases\xyz\extracted files\xyz-webhistory\Cookies[1420570].plist"

 
Posted : 08/01/2010 12:50 am
Share: