NSKeyedArchiver
| Format | NSKeyedArchiver |
|---|---|
| Short name | NSKeyedArchiver |
| Category | serialization |
| Platforms | macOS, iOS |
| Crush support | Supported (PlistParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Apple's object graph serialization format, stored as a binary plist (bplist00) with a specific internal structure. Identified by the root dictionary keys: '$archiver' = 'NSKeyedArchiver', '$top' (entry point), '$objects' (object table array), and '$version'. Objects are referenced by UID pointers into the $objects table — circular references and complex graphs are supported. Used pervasively in iOS and macOS for: app state restoration, UserDefaults (complex object values), CoreData metadata, clipboard payloads, Siri intent donations (INInteraction), some Biome streams (e.g. App Intents, embedded in protobuf records), and many app-specific data files. Custom file extensions are common (.sfl, .db, .archive) — a bplist header does not rule out NSKeyedArchiver encoding. Parsing requires a two-step process: first parse the bplist structure, then resolve UID references to reconstruct the object graph.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 24 61 72 63 68 69 76 65 72 | $archiver | '$archiver' key inside a binary plist (bplist00) — not detectable from the header |
Known extensions
.plist, .sfl, .archive
References
- NSKeyedArchiver files — what are they, and how can I use them? (CCL, Alex Caithness, 2012) https://digitalinvestigation.wordpress.com/2012/04/04/geek-post-nskeyedarchiver-files-what-are-they-and-how-can-i-use-them/
- Manual analysis of NSKeyedArchiver plist files (Sarah Edwards / mac4n6) http://www.mac4n6.com/blog/2016/1/1/manual-analysis-of-nskeyedarchiver-formatted-plist-files-a-review-of-the-new-os-x-1011-recent-items
- ccl_bplist — Python parser with NSKeyedArchiver support (CCL) https://github.com/cclgroupltd/ccl-bplist
- Analyzing iOS Biome AppIntent files — NSKeyedArchiver in practice (Blue Crew Forensics, John Hyla, 2022) https://bluecrewforensics.com/2022/03/07/ios-app-intents/
Cite this entry
Crush Format Reference, “NSKeyedArchiver”. https://kalink0.github.io/crush-forensics/formats/nskeyedarchiver/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction