...

Introduction

With the release of HstEx v3.6, we added the ability to search for, and recover, Apple Safari binary property lists (PList) from a bitstream. In this article, we will look at using HstEx to recovery binary PList data.

...

1. Select the source you want to search; HstEx supports a wide variety of different source formats.
2. Select the Export Folder where you want HstEx to recovery the files to (Export Folder).
3. Select the data type recovery module as "Safari History Files (Binary Plist History Entries)"; HstEx supports a number of different recovery type options.
4. Press the Start button to commence the recovery.
5. Clicking OK to save the Recovery Job (as seen in Figure 1).
6. At this point, you can go ahead and process this single job or add further recovery jobs to the queue (as seen in Figure 2).

Image Added

Figure 1 - HstEx® v4 Recovery Job 

Image Modified

Figure 1 - HstEx v4 2 - HstEx® v4 with a single job added

File Based Extraction (FBE)

...

When the recovery has completed, if HstEx has recovered (and validated) Apple Safari history binary plist files, they will be written out in the form of HSTX files.  

Figure 2 3 - HstEx 4 Recovery Output Files

...

See NetAnalysis Quick Start for further information.