Binary Property List
| Format | Binary Property List |
|---|---|
| Short name | bplist |
| Category | serialization |
| Platforms | macOS, iOS |
| Crush support | Supported (PlistParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
App preferences, caches, configuration, and iOS/macOS backup structures such as Manifest.plist and Info.plist. Many bplist files are NSKeyedArchiver object graphs — recognisable by the '$archiver' key — which can contain messages, contacts, health records, and other complex app data. Timestamps use Mac Absolute Time (seconds since 2001-01-01 UTC). Frequently embedded rather than stored as files: as BLOBs in SQLite databases and in extended attributes. Widely used across all Apple platforms and most third-party iOS/macOS apps.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 62 70 6C 69 73 74 | bplist | Binary plist magic ('bplist') |
Known extensions
.plist
References
- Apple CoreFoundation source (format spec) https://github.com/apple-oss-distributions/CF/blob/CF-550/CFBinaryPList.c
- Apple developer docs (Property Lists) https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFPropertyLists/
- Mobile Forensics – The File Format Handbook: Property Lists (Springer, 2022) https://doi.org/10.1007/978-3-030-98467-0_6
- NSKeyedArchiver plist forensics (Sarah Edwards / mac4n6) https://www.mac4n6.com/blog/tag/plist
- ccl-bplist Python module (CCL Solutions Group) https://github.com/cclgroupltd/ccl-bplist
Cite this entry
Crush Format Reference, “Binary Property List”. https://kalink0.github.io/crush-forensics/formats/bplist/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction