Decrypt ~/Library/Safari/Form Values file

Question

Level 1

82 points

Decrypt ~/Library/Safari/Form Values file

Hello, I need to get some data from the Safari Forms Autofill stuff, but after some research I've learned that the file is encrypted. Is there anyway, from my user position, that I can decrypt this file? Or is it pretty much not allowed and impossible? Thank you.

Laptop: IBM ThinkPad R40 - Desktop: Custom - Mac mini 2nd generation, Mac OS X (10.6.3), iPod touch 1G 8GB, iPhone 3G 8GB

Posted on Jun 15, 2010 8:00 PM

Reply

Answer 1

Jun 15, 2010 8:05 PM in response to osxdude

HI,

From the Safari Menu Bar click Safari/Preferences then select the Autofill tab.

All your autofill information is there, it's not encrypted.

Your user names and passwords are stored in your Keychain Access application located in
Applications/Utilities.

Carolyn 🙂

Reply

Answer 2

TildeBee

Level 7

31,917 points

Jun 15, 2010 8:18 PM in response to osxdude

osx --
If it's your account, you can click on the item you need info on, enter the Admin password
and it will let you in.

If it's not your account, it won't let you in, period.

Reply

Answer 3

osxdude Author

Level 1

82 points

Jun 15, 2010 11:12 PM in response to osxdude

I'm trying to get the information out of what would be categorized under "Other forms" but you can't get that information from within Safari.

When I click Edit next to the Other forms section, all I get is a dialog box that lists the sites where Safari has saved values for forms. I cannot see what these values are. Here is a screenshot: http://www.osxdude.com/screenshots/20100616011015.png

I guess this isn't very possible unless someone knows what encryption the file uses.

Reply

Answer 4

WMIF

Level 1

0 points

Jul 1, 2013 10:34 PM in response to osxdude

Very old thread here, but there is new information on the encryption on this blog post. You can get the values out with this tool.

http://encase-forensic-blog.guidancesoftware.com/2013/06/safari-form-values-decr yptor.html

Reply