Property List (XML plist)
| Format | Property List (XML plist) |
|---|---|
| Short name | XML plist |
| Category | serialization |
| Platforms | macOS, iOS |
| Crush support | Supported (PlistParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Human-readable Apple property list format using XML serialization. Used for app preferences, configuration files, system settings, and iTunes/Xcode metadata. Info.plist in every iOS/macOS app bundle declares: bundle identifier (CFBundleIdentifier), version (CFBundleShortVersionString/CFBundleVersion), minimum OS version, the app's own URL schemes (CFBundleURLTypes) and the schemes it queries in other apps (LSApplicationQueriesSchemes), privacy usage descriptions (NSCamera/NSLocation/NSMicrophoneUsageDescription), background modes (UIBackgroundModes), and required device capabilities — key fields for app profiling and capability assessment. Dates are stored as ISO 8601 strings. Functionally equivalent to binary plist (bplist). Identified by XML declaration and Apple plist DOCTYPE. Some plists use JSON format in rare cases. Hardcoded API keys or credentials in Info.plist are a common security finding in app analysis.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 3C 3F 78 6D 6C | <?xml | XML declaration ('<?xml') |
| offset unknown | 3C 21 44 4F 43 54 59 50 45 20 70 6C 69 73 74 | <!DOCTYPE plist | Apple plist DOCTYPE after the XML declaration — distinguishes a plist from generic XML |
Known extensions
.plist
References
- Apple property list format overview (Apple developer docs) https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html
- Property list (Wikipedia — covers XML, binary, JSON variants) https://en.wikipedia.org/wiki/Property_list
- Mobile Forensics – The File Format Handbook: Property Lists (Springer, 2022) https://doi.org/10.1007/978-3-030-98467-0_6
- iOS plist forensics guide (mac4n6 / Sarah Edwards) https://www.mac4n6.com/blog/tag/plist
Cite this entry
Crush Format Reference, “Property List (XML plist)”. https://kalink0.github.io/crush-forensics/formats/xml-plist/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction