Pulling Content Out Of OS X Cache.db Files

This post was written by Chris Latko on May 19, 2009
Posted Under: Apple

I’m not sure when, but most likely when Leopard was released, applications started storing their cache files as sqlite databases (usually named Cache.db). For example, Safari has its cache at:

~/Library/Caches/com.apple.Safari/Cache.db

Apps that haven’t caught up yet are still using the less-efficient .cache files. Though not as efficient, these files are easier to access, just toss it onto BBEdit and you can see the contents. Try doing this with a 100+MB .db file and prepare to wait.

There probably is a GUI app to extract data from .db cache files, but I’m too lazy for that. OS X has everything you need already built in so fire up Terminal.app (I’ve been playing with Visor lately) and dig into your cache:

# cd ~/Library/Caches/com.apple.Safari/
# sqlite3 Cache.db

You’ll be in the sqlite interactive mode:

sqlite> select * from cfurl_cache_response;
sqlite> select receiver_data from cfurl_cache_blob_data where entry_ID = [1234];

To output the data to a file use the following:

sqlite> .output test.html
sqlite> select receiver_data from cfurl_cache_blob_data where entry_ID = [1234];
sqlite> .exit

That should do it. Any questions? Leave a comment.

2 Tweets

Comments RSSComments

Hi everyone,

it didn't works….
i delete the [ character but and it works better but I don't have the data in the output file ??!!

Could you help me ??

#1 
Written By Simon on September 14th, 2009 @ 9:42 am

What OS X version are you running? Also, you should try a different query just to get SOME kind of output. Maybe "select receiver_data from cfurl_cache_blob_data;" (leaving out the WHERE altogether). Does this get you any closer?

#2 
Written By Chris Latko on September 16th, 2009 @ 2:26 am

say that I can see the BLOB in a record - how do you know if its an html, image or what?

#3 
Written By David on October 15th, 2009 @ 8:17 am

You'll probably have to save it as a text file and check the first couple lines for clues as to what type of file it is. Usually there is embedded meta-data such as PNG/PDF/JPG etc. Sorry, I can't be more specific.

#4 
Written By Chris Latko on October 26th, 2009 @ 8:08 pm

Pulling Content Out Of OS X Cache.db Files @ http://bit.ly/2QkquB (via @clatko)

This comment was originally posted on Twitter

#5 
Written By BurielWebwerx on May 20th, 2009 @ 7:35 am

Pull Content Out of OS X Cache.db Files - http://bit.ly/SkcKt

This comment was originally posted on Twitter

#6 
Written By sandman25 on May 22nd, 2009 @ 9:31 am

Add a Comment

required, use real name
required, will not be published
optional, your blog address

Additional comments powered by BackType