<div id="readability-page-1" class="page"><div>
      
        <header>
          
          

  <p>
    

    

    
      
      

      <span>
        
        
          5 minute read
        
      </span>
    
  </p>


        </header>
      

      <section itemprop="text">
        
        <h2 id="tracing-safari-navigation-history-in-the-ios-simulator-with-forensic-techniques">Tracing Safari Navigation History in the iOS Simulator with Forensic Techniques</h2>

<h2 id="goal">Goal</h2>

<p>I want to boot an iOS simulator on macOS and find out where a page opened in a new Safari tab navigated to.</p>

<p>Normally you would debug this with Safari devtools, but when a link opens a new browser tab, devtools can’t show you the navigation. To capture it you would need devtools already attached to that Safari tab — and you can’t attach devtools to a tab that doesn’t exist yet.</p>



<p>Safari devtools is out, but the Xcode developer tools are not. We’ll use <code>xcrun simctl</code> from the command line instead.</p>

<h3 id="xcrun">xcrun</h3>

<p><code>xcrun</code> is the tool that lets you invoke Xcode developer tools from the command line.</p>

<h4 id="references">References</h4>

<ul>
  <li><a href="https://github.com/lana-20/xcrun_commands">xcrun_commands</a></li>
  <li><a href="https://www.unix.com/man_page/osx/1/xcrun/">xcrun man page</a></li>
</ul>

<h3 id="simctl">simctl</h3>

<p><code>simctl</code> is the command line utility Xcode provides for controlling simulators.</p>

<p>To confirm it works, let’s stream the logs of the running simulator.</p>

<div><pre><code>xcrun simctl spawn booted log stream --predicate 'process == "MobileSafari"' --style compact
</code></pre></div>

<p>Now let’s list the simulators that are currently running.</p>

<div><pre><code>xcrun simctl list devices booted
</code></pre></div>

<p>The output looks roughly like this. What matters is the UDID of the instance marked <code>Booted</code> — in the example below, <code>077928C7-026B-4D15-AC8C-C992B910D0C4</code>. Everything about that simulator instance is looked up by this UDID.</p>

<div><pre><code>ys-m4pro@youngseonui-MacBookPro Safari % xcrun simctl list devices booted
== Devices ==
-- iOS 26.2 --
-- iOS 26.4 --
-- iOS 26.5 --
    iPhone 17 (077928C7-026B-4D15-AC8C-C992B910D0C4) (Booted)
</code></pre></div>

<h4 id="references-1">References</h4>

<ul>
  <li><a href="https://medium.com/xcblog/simctl-control-ios-simulators-from-command-line-78b9006a20dc">simctl: Control iOS Simulators from Command Line</a></li>
  <li><a href="https://suelan.github.io/2020/02/05/iOS-Simulator-from-the-Command-Line/">iOS Simulator from the Command Line</a></li>
</ul>

<h3 id="safari-historydb">Safari History.db</h3>

<p>As of iOS 26.5, iOS Safari stores history and similar data in SQLite files. There’s no official documentation for this, but the forensics pioneers have already dug most of it up. Reading Plaso’s parser is a good place to start.</p>

<p><a href="https://plaso-fork.readthedocs.io/en/latest/_modules/plaso/parsers/sqlite_plugins/safari.html">Source code for plaso.parsers.sqlite_plugins.safari</a></p>

<p>So where is Safari’s <code>History.db</code>? This is where the simulator instance UDID from above comes in. Head to this directory:</p>

<div><pre><code>~/Library/Developer/CoreSimulator/Devices/[UDID from xcrun simctl]/data/Library/Safari
</code></pre></div>

<p>There’s all kinds of data in here.</p>

<div><pre><code>ys-m4pro@youngseonui-MacBookPro Safari % ls -lh
total 11240
-rw-r--r--  1 ys-m4pro  staff   139K  Aug  3 16:32 AutoFillQuirks.plist
-rw-r--r--  1 ys-m4pro  staff   4.0K  Jun  8 11:34 Bookmarks.db
-rw-r--r--  1 ys-m4pro  staff    32K  Aug  3 16:33 Bookmarks.db-shm
-rw-r--r--  1 ys-m4pro  staff   515K  Jun  8 11:36 Bookmarks.db-wal
-rw-r--r--  1 ys-m4pro  staff   4.0K  Jun  8 11:33 BrowserState.db
-rw-r--r--  1 ys-m4pro  staff    32K  Aug  3 16:34 BrowserState.db-shm
-rw-r--r--  1 ys-m4pro  staff    60K  Jun  8 11:33 BrowserState.db-wal
-rw-r--r--@ 1 ys-m4pro  staff    40K  Jun  8 11:34 CloudTabs.db
-rw-r--r--  1 ys-m4pro  staff    32K  Aug  3 17:24 CloudTabs.db-shm
-rw-r--r--  1 ys-m4pro  staff     0B  Jun  8 11:34 CloudTabs.db-wal
-rw-r--r--  1 ys-m4pro  staff     0B  Jun  8 11:34 com.apple.Bookmarks.lock
-rw-r--r--@ 1 ys-m4pro  staff   4.0K  Jun  8 11:34 History.db
-rw-r--r--@ 1 ys-m4pro  staff    32K  Aug  4 09:00 History.db-shm
-rw-r--r--@ 1 ys-m4pro  staff   3.6M  Aug  4 09:24 History.db-wal
-rw-r--r--  1 ys-m4pro  staff   208K  Aug  3 20:39 SafariTabs.db
-rw-r--r--  1 ys-m4pro  staff    32K  Aug  3 16:32 SafariTabs.db-shm
-rw-r--r--  1 ys-m4pro  staff   258K  Aug  4 09:24 SafariTabs.db-wal
</code></pre></div>

<p>The file we want is <code>History.db</code>. If you want to keep a snapshot of the database, save <code>History.db</code>, <code>History.db-wal</code>, and <code>History.db-shm</code> together. The three are one set.</p>

<h3 id="sqlite3">sqlite3</h3>

<p>Reading the data is straightforward — just open <code>History.db</code> with sqlite3. Prefer the <code>-readonly</code> option; reading can modify the database.</p>

<div><pre><code>ys-m4pro@youngseonui-MacBookPro Safari % sqlite3 -readonly History.db
SQLite version 3.51.0 2025-06-12 13:14:41
Enter ".help" for usage hints.
</code></pre></div>

<p>Let’s list the tables inside <code>History.db</code>.</p>

<div><pre><code>sqlite&gt; .tables
history_client_versions  history_items            history_tombstones
history_event_listeners  history_items_to_tags    history_visits
history_events           history_tags             metadata
</code></pre></div>

<p>You can also inspect the schema of a specific table.</p>

<div><pre><code>sqlite&gt; .schema history_visits
CREATE TABLE history_visits (id INTEGER PRIMARY KEY AUTOINCREMENT,history_item INTEGER NOT NULL REFERENCES history_items(id) ON DELETE CASCADE,visit_time REAL NOT NULL,title TEXT NULL,load_successful BOOLEAN NOT NULL DEFAULT 1,http_non_get BOOLEAN NOT NULL DEFAULT 0,synthesized BOOLEAN NOT NULL DEFAULT 0,redirect_source INTEGER NULL UNIQUE REFERENCES history_visits(id) ON DELETE CASCADE,redirect_destination INTEGER NULL UNIQUE REFERENCES history_visits(id) ON DELETE CASCADE,origin INTEGER NOT NULL DEFAULT 0,generation INTEGER NOT NULL DEFAULT 0,attributes INTEGER NOT NULL DEFAULT 0,score INTEGER NOT NULL DEFAULT 0);
CREATE INDEX history_visits__last_visit ON history_visits (history_item, visit_time DESC, synthesized ASC);
CREATE INDEX history_visits__origin ON history_visits (origin, generation);
</code></pre></div>

<h2 id="action">Action</h2>

<p>Referring to <a href="https://plaso-fork.readthedocs.io/en/latest/_modules/plaso/parsers/sqlite_plugins/safari.html">Source code for plaso.parsers.sqlite_plugins.safari</a>, let’s pull just the 10 most recent navigations. <code>visit_time</code> is in seconds since the Apple reference date (2001-01-01 GMT), so add <code>+978307200</code> to convert it to Unix epoch.</p>

<div><pre><code>sqlite&gt; .mode box
sqlite&gt; select v.id,
   ...&gt;        datetime(v.visit_time+978307200,'unixepoch','localtime') t,
   ...&gt;        i.url
   ...&gt; from history_visits v
   ...&gt; join history_items i on i.id = v.history_item
   ...&gt; order by v.visit_time desc, v.id desc
   ...&gt; limit 10;
┌────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│ id │          t          │                             url                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 85 │ 2026-08-04 11:08:20 │ https://m.epic.ai.kr/?utm_source=naver&amp;utm_medium=brandsearc │
│    │                     │ h&amp;utm_campaign=MO&amp;utm_id=search                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 84 │ 2026-08-04 11:08:20 │ https://m.epic.ai.kr/?utm_source=naver&amp;utm_medium=brandsearc │
│    │                     │ h&amp;utm_campaign=MO&amp;utm_id=search                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 83 │ 2026-08-04 09:24:16 │ https://m.epic.ai.kr/copilot/36b7f134-1581-4c83-90d1-df71482 │
│    │                     │ 0f1b8                                                        │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 82 │ 2026-08-04 09:24:12 │ https://m.epic.ai.kr/copilot                                 │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 81 │ 2026-08-03 17:20:01 │ https://m.epic.ai.kr/copilot/36b7f134-1581-4c83-90d1-df71482 │
│    │                     │ 0f1b8                                                        │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 80 │ 2026-08-03 17:20:00 │ https://m.epic.ai.kr/copilot/conversations-list              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 79 │ 2026-08-03 17:19:58 │ https://m.epic.ai.kr/copilot                                 │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 78 │ 2026-08-03 16:55:37 │ https://m.epic.ai.kr/?utm_source=naver&amp;utm_medium=brandsearc │
│    │                     │ h&amp;utm_campaign=MO&amp;utm_id=search                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 77 │ 2026-08-03 16:55:37 │ https://m.epic.ai.kr/?utm_source=naver&amp;utm_medium=brandsearc │
│    │                     │ h&amp;utm_campaign=MO&amp;utm_id=search                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 76 │ 2026-08-03 16:51:55 │ https://ad-creative.gfa.naver.com/widget/preview.html?creati │
│    │                     │ veId=6a703f4a8965ead565d1266f&amp;fullwidth                      │
└────┴─────────────────────┴──────────────────────────────────────────────────────────────┘
</code></pre></div>

<p>The top row is the most recent. Read upward from the bottom and you get the browser’s navigation history leading up to the current page. In the result above, id 76 → 77 is the case where a link opened a new browser tab and navigated.</p>

<h2 id="caveats">Caveats</h2>

<h3 id="1-whether-a-new-tab-was-opened">1. Whether a new tab was opened</h3>

<p>Unfortunately, <code>History.db</code> keeps no record of whether a new tab was involved. Browser tabs are recorded in <code>SafariTabs.db</code>, but there’s no key that ties it back to <code>History.db</code>.</p>

<h3 id="2-sometimes-you-get-2-rows-sometimes-1">2. Sometimes you get 2 rows, sometimes 1</h3>

<p>Here’s why.</p>

<p>When a SPA initializes, react-router calls <code>replaceState</code>. At that moment:</p>

<ul>
  <li><code>History.db</code> → adds one row (ids 77–78 and 84–85 in the example above)</li>
  <li>browser history API stack → adds nothing</li>
</ul>

<p>So the entries on the browser history API stack and the rows in <code>History.db</code> cannot be mapped one to one.</p>

<p>A document navigation or an in-app SPA navigation adds exactly one row to <code>History.db</code> and one entry to the browser history API stack.</p>

<h2 id="summary">Summary</h2>

<p>When browser devtools can’t get you there, forensic techniques can.</p>

<p>20260804</p>

<p>EOD</p>

        
      </section>

      

      


      
  


    </div></div>

Never test

Tracing Safari Navigation History in the iOS Simulator with Forensic Techniques
Goal
I want to boot an iOS simulator on macOS and find out where a page opened in a new Safari tab navigated to.
Normally you would debug this with Safari devtools, but when a link opens a new browser tab, devtools can’t show you the navigation. To capture it you would need devtools already attached to that Safari tab — and you can’t attach devtools to a tab that doesn’t exist yet.
Tools
Safari devtools is out, but the Xcode developer tools are not. We’ll use xcrun simctl from the command line instead.
xcrun
xcrun is the tool that lets you invoke Xcode developer tools from the command line.
References
xcrun_commands
xcrun man page
simctl
simctl is the command line utility Xcode provides for controlling simulators.
To confirm it works, let’s stream the logs of the running simulator.
xcrun simctl spawn booted log stream --predicate 'process == "MobileSafari"' --style compact
Now let’s list the simulators that are currently running.
xcrun simctl list devices booted
The output looks roughly like this. What matters is the UDID of the instance marked Booted — in the example below, 077928C7-026B-4D15-AC8C-C992B910D0C4. Everything about that simulator instance is looked up by this UDID.
ys-m4pro@youngseonui-MacBookPro Safari % xcrun simctl list devices booted
== Devices ==
-- iOS 26.2 --
-- iOS 26.4 --
-- iOS 26.5 --
    iPhone 17 (077928C7-026B-4D15-AC8C-C992B910D0C4) (Booted)
References
simctl: Control iOS Simulators from Command Line
iOS Simulator from the Command Line
Safari History.db
As of iOS 26.5, iOS Safari stores history and similar data in SQLite files. There’s no official documentation for this, but the forensics pioneers have already dug most of it up. Reading Plaso’s parser is a good place to start.
Source code for plaso.parsers.sqlite_plugins.safari
So where is Safari’s History.db? This is where the simulator instance UDID from above comes in. Head to this directory:
~/Library/Developer/CoreSimulator/Devices/[UDID from xcrun simctl]/data/Library/Safari
There’s all kinds of data in here.
ys-m4pro@youngseonui-MacBookPro Safari % ls -lh
total 11240
-rw-r--r--  1 ys-m4pro  staff   139K  Aug  3 16:32 AutoFillQuirks.plist
-rw-r--r--  1 ys-m4pro  staff   4.0K  Jun  8 11:34 Bookmarks.db
-rw-r--r--  1 ys-m4pro  staff    32K  Aug  3 16:33 Bookmarks.db-shm
-rw-r--r--  1 ys-m4pro  staff   515K  Jun  8 11:36 Bookmarks.db-wal
-rw-r--r--  1 ys-m4pro  staff   4.0K  Jun  8 11:33 BrowserState.db
-rw-r--r--  1 ys-m4pro  staff    32K  Aug  3 16:34 BrowserState.db-shm
-rw-r--r--  1 ys-m4pro  staff    60K  Jun  8 11:33 BrowserState.db-wal
-rw-r--r--@ 1 ys-m4pro  staff    40K  Jun  8 11:34 CloudTabs.db
-rw-r--r--  1 ys-m4pro  staff    32K  Aug  3 17:24 CloudTabs.db-shm
-rw-r--r--  1 ys-m4pro  staff     0B  Jun  8 11:34 CloudTabs.db-wal
-rw-r--r--  1 ys-m4pro  staff     0B  Jun  8 11:34 com.apple.Bookmarks.lock
-rw-r--r--@ 1 ys-m4pro  staff   4.0K  Jun  8 11:34 History.db
-rw-r--r--@ 1 ys-m4pro  staff    32K  Aug  4 09:00 History.db-shm
-rw-r--r--@ 1 ys-m4pro  staff   3.6M  Aug  4 09:24 History.db-wal
-rw-r--r--  1 ys-m4pro  staff   208K  Aug  3 20:39 SafariTabs.db
-rw-r--r--  1 ys-m4pro  staff    32K  Aug  3 16:32 SafariTabs.db-shm
-rw-r--r--  1 ys-m4pro  staff   258K  Aug  4 09:24 SafariTabs.db-wal
The file we want is History.db. If you want to keep a snapshot of the database, save History.db, History.db-wal, and History.db-shm together. The three are one set.
sqlite3
Reading the data is straightforward — just open History.db with sqlite3. Prefer the -readonly option; reading can modify the database.
ys-m4pro@youngseonui-MacBookPro Safari % sqlite3 -readonly History.db
SQLite version 3.51.0 2025-06-12 13:14:41
Enter ".help" for usage hints.
Let’s list the tables inside History.db.
sqlite> .tables
history_client_versions  history_items            history_tombstones
history_event_listeners  history_items_to_tags    history_visits
history_events           history_tags             metadata
You can also inspect the schema of a specific table.
sqlite> .schema history_visits
CREATE TABLE history_visits (id INTEGER PRIMARY KEY AUTOINCREMENT,history_item INTEGER NOT NULL REFERENCES history_items(id) ON DELETE CASCADE,visit_time REAL NOT NULL,title TEXT NULL,load_successful BOOLEAN NOT NULL DEFAULT 1,http_non_get BOOLEAN NOT NULL DEFAULT 0,synthesized BOOLEAN NOT NULL DEFAULT 0,redirect_source INTEGER NULL UNIQUE REFERENCES history_visits(id) ON DELETE CASCADE,redirect_destination INTEGER NULL UNIQUE REFERENCES history_visits(id) ON DELETE CASCADE,origin INTEGER NOT NULL DEFAULT 0,generation INTEGER NOT NULL DEFAULT 0,attributes INTEGER NOT NULL DEFAULT 0,score INTEGER NOT NULL DEFAULT 0);
CREATE INDEX history_visits__last_visit ON history_visits (history_item, visit_time DESC, synthesized ASC);
CREATE INDEX history_visits__origin ON history_visits (origin, generation);
Action
Referring to Source code for plaso.parsers.sqlite_plugins.safari, let’s pull just the 10 most recent navigations. visit_time is in seconds since the Apple reference date (2001-01-01 GMT), so add +978307200 to convert it to Unix epoch.
sqlite> .mode box
sqlite> select v.id,
   ...>        datetime(v.visit_time+978307200,'unixepoch','localtime') t,
   ...>        i.url
   ...> from history_visits v
   ...> join history_items i on i.id = v.history_item
   ...> order by v.visit_time desc, v.id desc
   ...> limit 10;
┌────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│ id │          t          │                             url                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 85 │ 2026-08-04 11:08:20 │ https://m.epic.ai.kr/?utm_source=naver&utm_medium=brandsearc │
│    │                     │ h&utm_campaign=MO&utm_id=search                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 84 │ 2026-08-04 11:08:20 │ https://m.epic.ai.kr/?utm_source=naver&utm_medium=brandsearc │
│    │                     │ h&utm_campaign=MO&utm_id=search                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 83 │ 2026-08-04 09:24:16 │ https://m.epic.ai.kr/copilot/36b7f134-1581-4c83-90d1-df71482 │
│    │                     │ 0f1b8                                                        │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 82 │ 2026-08-04 09:24:12 │ https://m.epic.ai.kr/copilot                                 │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 81 │ 2026-08-03 17:20:01 │ https://m.epic.ai.kr/copilot/36b7f134-1581-4c83-90d1-df71482 │
│    │                     │ 0f1b8                                                        │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 80 │ 2026-08-03 17:20:00 │ https://m.epic.ai.kr/copilot/conversations-list              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 79 │ 2026-08-03 17:19:58 │ https://m.epic.ai.kr/copilot                                 │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 78 │ 2026-08-03 16:55:37 │ https://m.epic.ai.kr/?utm_source=naver&utm_medium=brandsearc │
│    │                     │ h&utm_campaign=MO&utm_id=search                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 77 │ 2026-08-03 16:55:37 │ https://m.epic.ai.kr/?utm_source=naver&utm_medium=brandsearc │
│    │                     │ h&utm_campaign=MO&utm_id=search                              │
├────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ 76 │ 2026-08-03 16:51:55 │ https://ad-creative.gfa.naver.com/widget/preview.html?creati │
│    │                     │ veId=6a703f4a8965ead565d1266f&fullwidth                      │
└────┴─────────────────────┴──────────────────────────────────────────────────────────────┘
The top row is the most recent. Read upward from the bottom and you get the browser’s navigation history leading up to the current page. In the result above, id 76 → 77 is the case where a link opened a new browser tab and navigated.
Caveats
1. Whether a new tab was opened
Unfortunately, History.db keeps no record of whether a new tab was involved. Browser tabs are recorded in SafariTabs.db, but there’s no key that ties it back to History.db.
2. Sometimes you get 2 rows, sometimes 1
Here’s why.
When a SPA initializes, react-router calls replaceState. At that moment:
History.db → adds one row (ids 77–78 and 84–85 in the example above)
browser history API stack → adds nothing
So the entries on the browser history API stack and the rows in History.db cannot be mapped one to one.
A document navigation or an in-app SPA navigation adds exactly one row to History.db and one entry to the browser history API stack.
Summary
When browser devtools can’t get you there, forensic techniques can.
20260804
EOD

Tracing Safari Navigation History in the iOS Simulator with Forensic Techniques

댓글