Apple Binary Cookies
| Format | Apple Binary Cookies |
|---|---|
| Short name | binarycookies |
| Category | database |
| Platforms | macOS, iOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Cookie store of Safari and WebKit-based apps (Cookies.binarycookies) on macOS and iOS, found in the user's and in app-specific Library/Cookies directories. A big-endian file header lists the page sizes; each page holds little-endian cookie records with domain, name, path, value, flags (secure, HTTP-only) and expiration and creation times as Cocoa timestamps (seconds since 2001-01-01 UTC). Cookies reveal visited services, logged-in accounts and their creation time, also for apps with embedded web views.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 63 6F 6F 6B | cook | Signature 'cook' |
Known extensions
.binarycookies
References
- Safari cookies file format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/Safari%20Cookies.asciidoc
Cite this entry
Crush Format Reference, “Apple Binary Cookies”. https://kalink0.github.io/crush-forensics/formats/binarycookies/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction