Clear Safari Artifacts

A subject clears Apple Safari browser artifacts to conceal websites visited, files downloaded, searches performed, authenticated sessions, or other browser-based activity. The subject may clear browsing history for a selected period, remove cookies, cache, and other website data, clear download records, or directly delete or alter locally stored Safari data.

Where Safari synchronization is enabled, clearing browsing history may also remove synchronized history from other Apple devices associated with the account. Investigators should examine macOS file-system activity, browser database metadata, endpoint telemetry, and independently retained web records to identify deletion, truncation, or recreation of Safari artifacts. Local evidence should be compared with web proxy, Domain Name System (DNS), authentication, and cloud-service logs.