I am examining a Safari cookies.plist file from a Mac. Some of the cookies have dates that have integer and fractional parts. These dates correctly evaluate to dates in the 2006-2009 range. Some of the cookies, unfortunately the ones I need, have only an integer part and don't evaluate to any sensible date. Does anyone know how they are encoded?
Note Safari cookies 'Created' key is SUPPOSED to be a CFAbsoluteTime, which means the number of seconds since Jan 1st, 2001. To convert this in Excel, for example, use =CreatedTime/(60*60*24)+DATE(2001,1,1)
Note2 I am working on Windows so I cannot use Mac-only tools.
Here is a relevant clip
<dict>
<key>Created</key>
<real>260192144.15709901</real>
<key>Domain</key>
<string>.photobucket.com</string>
<key>Expires</key>
<date>2012-02-29T235959Z</date>
<key>Name</key>
<string>XYZ</string>
<key>Path</key>
<string>/</string>
<key>Value</key>
<string>+1smIeJc4+314+4</string>
</dict>
<dict>
<key>Created</key>
<real>299546270</real>
<key>Domain</key>
<string>.incriminatingsite.com</string>
<key>Expires</key>
<date>2010-07-06T173017Z</date>
<key>Name</key>
<string>aHSM</string>
<key>Path</key>
<string>/</string>
<key>Value</key>
<string>12S888882568888B</string>
</dict>
The example you give decodes to a valid time as far as I can see, although in the future. System clock wrong from the originating system?
IIRC the fractional side of the time value makes no difference when converting the date/time in excel ( you can leave it out and get the same value).
Do you have any URL history/cache records showing the same discrepancy of 'incrimatinsite.com's date and time?
Have you tried the SFT (Safari Forensic Tools)?
They are written in objective C (for MacOs) and therefore will should correctly load the XML and binary formats for the Safari web browser. There is a window binary download that includes the objective C runtime etc.
http//
or if you have perl installed then you could try http//
I have used both and they seem to work ok.
As far as I know, they are always CFAbsoluteTime.
No luck.
plutil converts it to a binary plist, but SFT errors on both the XML and the binary
L\Library\Software\Mac tools\SFT-1.1.1-WIN>safari_cookies.exe "L\Cases\xyz\extracted files\xyz-webhistory\Cookies[1420570].plist"
2010-01-07 143859.495 safari_cookies.exe[4036] File NSUserDefaults.m 562. In
[NSUserDefaults +standardUserDefaults] Improper installation No language locale
found
2010-01-07 143859.651 safari_cookies.exe[4036] File NSArray.m 732. In [GSPlac
eholderArray -initWithContentsOfFile] Contents of file 'L\Cases\xyz\extracted files\xyz-webhistory\Cookies[1420570].plist' does not contain an array
ERROR Couldn't parse "L\Cases\xyz\extracted files\xyz-webhistory\Cookies[1420570].plist"