A little-known feature in Safari’s browsing-history database can provide investigators with an additional layer of context about a macOS user’s web activity.
Documented by Swiftforensics, Safari appears to assign semantic tags to some visited pages, potentially exposing broader browsing themes even when individual URLs are incomplete, ambiguous, or no longer associated with active history records.
The artifact resides in Safari’s SQLite history database at ~/Library/Safari/History.db, the same location commonly used to reconstruct a user’s browsing timeline.
Safari History Tags Expose Browsing Themes
Traditional examination focuses on history_items, which stores unique URLs, and history_visits, which records individual page visits. However, two additional tables history_tags and history_items_to_tags can reveal how Safari categorizes selected content.
The history_tags table contains the tag metadata, including a human-readable value in the title field, a persistent identifier, a modification timestamp, and an item_count showing how many Safari history records are currently associated with the tag.
The history_items_to_tags table operates as the relationship table, tying an item in Safari history to its assigned tag. Database triggers increment or decrement the tag’s item count when those relationships are created or removed.
Safari’s tagging does not appear to cover every page, and Apple has not publicly documented the exact logic used to generate a tag.
In practical testing, most assigned tags appear thematically related to their source pages, though they may not capture the page’s primary subject.
SwiftForensics stated that this limitation means examiners should treat tags as contextual indicators rather than definitive descriptions of user intent or activity.
A notable detail is the identifier value in history_tags, which begins with the letter “Q.” These identifiers correspond to Wikidata items, indicating that Safari’s categorization can be linked to a broader knowledge-graph entity rather than merely a locally generated keyword.
This may help investigators distinguish between similarly named terms, but it also creates room for misleading interpretations when a tag has multiple technical meanings.
For example, a Safari tag labeled “APT,” associated with Wikidata item Q230724, could initially appear to suggest advanced persistent threat activity. In the observed case, however, the identifier referred to the Advanced Package Tool used in Linux and Homebrew-related contexts.
The relevant page was a phishing site impersonating the real Homebrew website, while the legitimate Homebrew page received no tag.
The example illustrates why analysts must validate a tag against the underlying URL, page title, visit timeline, and surrounding evidence before drawing conclusions.
The tag modification timestamp uses Apple’s NSDate, or Cocoa, epoch beginning on January 1, 2001. Converting it alongside Safari visit timestamps can help establish when a topic-linked page was last accessed.
Investigators should also acquire the associated History.db-wal and History.db-shm files, because recent records may remain in Safari’s write-ahead log before being committed to the primary database.
Deleted browsing data may also leave investigative value. While clearing Safari history can remove associated tag records, some systems have retained older tag entries with an item_count of zero, meaning no current history item is linked to them.
These orphaned tags are not standalone proof of browsing activity, but they may point analysts toward past themes worthy of corroboration through browser caches, downloads, DNS artifacts, unified logs, or recovered SQLite records.
The open-source macOS forensic framework mac_apt has added Safari tag parsing, displaying tags without associated item counts as “TAGGED.” This makes the artifact more accessible in routine DFIR workflows and reinforces the value of examining Safari history beyond URLs and timestamps alone.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
