Add Safari (macOS) parser

admin/test/cases/testdata.safaribrowsing.json

@@ -0,0 +1,80 @@
+{
+  "case1": {
+    "description": "Real macOS 11.2.1 (Big Sur) device data from Josh Hickman's public forensic training image (thisisdfir account), same source as the Keychains and iMessage case1 fixtures. Validates all six Safari artifacts: History (27 visits), Bookmarks (7 bookmarks), Top Sites (12 entries), Recently Closed Tabs (2 tabs), iCloud Tabs/CloudTabs.db (2 synced tabs), and Last Session/Open Tabs (2 tabs). All six artifacts returned real, non-empty data — no known gaps for this case.",
+    "maker": "@Gear-I",
+    "make_data": {
+      "input_data_path": "macOS-BigSur-full.zip",
+      "os": "macOS-26.5.2-arm64-arm-64bit-Mach-O",
+      "timestamp": "2026-08-30T10:35:10.712953",
+      "last_commit": {
+        "hash": "3a6007b031dd3b7a749e75cb161e658d24260306",
+        "author_name": "Dielle De Noon",
+        "author_email": "N/A",
+        "date": "2026-08-30T10:30:56-04:00",
+        "message": "Corrected results for Recently Closed Tabs for Safari"
+      }
+    },
+    "artifacts": {
+      "safariHistory": {
+        "search_patterns": [
+          "*/Library/Safari/History.db*"
+        ],
+        "file_count": 2,
+        "expected_output": {
+          "headers": [],
+          "data": []
+        }
+      },
+      "safariBookmarks": {
+        "search_patterns": [
+          "*/Library/Safari/Bookmarks.plist"
+        ],
+        "file_count": 1,
+        "expected_output": {
+          "headers": [],
+          "data": []
+        }
+      },
+      "safariTopSites": {
+        "search_patterns": [
+          "*/Library/Safari/TopSites.plist"
+        ],
+        "file_count": 1,
+        "expected_output": {
+          "headers": [],
+          "data": []
+        }
+      },
+      "safariRecentlyClosedTabs": {
+        "search_patterns": [
+          "*/Library/Safari/RecentlyClosedTabs.plist"
+        ],
+        "file_count": 1,
+        "expected_output": {
+          "headers": [],
+          "data": []
+        }
+      },
+      "safariCloudTabs": {
+        "search_patterns": [
+          "*/Library/Safari/CloudTabs.db*"
+        ],
+        "file_count": 2,
+        "expected_output": {
+          "headers": [],
+          "data": []
+        }
+      },
+      "safariLastSession": {
+        "search_patterns": [
+          "*/Library/Safari/LastSession.plist"
+        ],
+        "file_count": 1,
+        "expected_output": {
+          "headers": [],
+          "data": []
+        }
+      }
+    }
+  }
+}

admin/test/results/safaribrowsing/safaribrowsing.safariBookmarks.case1.20260830143822.json

@@ -0,0 +1,82 @@
+{
+  "metadata": {
+    "module_name": "safaribrowsing",
+    "artifact_name": "Safari Bookmarks",
+    "function_name": "safariBookmarks",
+    "case_number": "case1",
+    "number_of_columns": 5,
+    "number_of_rows": 7,
+    "total_data_size_bytes": 1057,
+    "media_checkins": 0,
+    "media_embedded_checkins": 0,
+    "input_zip_path": "admin/test/cases/data/safaribrowsing/testdata.safaribrowsing.safariBookmarks.case1.zip",
+    "start_time": "2026-08-30T14:38:22.422183+00:00",
+    "end_time": "2026-08-30T14:38:22.431801+00:00",
+    "run_time_seconds": 0.00018095970153808594,
+    "last_commit": {
+      "hash": "3a6007b031dd3b7a749e75cb161e658d24260306",
+      "author_name": "Dielle De Noon",
+      "author_email": "dielleaiko@hotmail.com",
+      "date": "2026-08-30T10:30:56-04:00",
+      "message": "Corrected results for Recently Closed Tabs for Safari"
+    }
+  },
+  "headers": [
+    "Folder Path",
+    "Title",
+    "URL",
+    "Bookmark UUID",
+    "Source File"
+  ],
+  "data": [
+    [
+      "BookmarksBar",
+      "Apple",
+      "https://www.apple.com/",
+      "4D98B1AE-8E3C-47E3-B6C1-C2FB7865F045",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/Bookmarks.plist"
+    ],
+    [
+      "BookmarksBar",
+      "Bing",
+      "https://www.bing.com/",
+      "C99275EB-0F49-4F80-8823-3564FF998F56",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/Bookmarks.plist"
+    ],
+    [
+      "BookmarksBar",
+      "Google",
+      "https://www.google.com/?client=safari&channel=iphone_bm",
+      "5B538E3C-D440-444A-A41E-B05BBFE4F5C5",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/Bookmarks.plist"
+    ],
+    [
+      "BookmarksBar",
+      "Yahoo",
+      "https://yahoo.com/",
+      "BC105CB7-4BA4-4112-BE3C-334AA82F6FBD",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/Bookmarks.plist"
+    ],
+    [
+      "BookmarksBar",
+      "Mac Rumors",
+      "https://www.macrumors.com/",
+      "BDE4ABCD-0A5C-4453-9D66-8C69CDBA5840",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/Bookmarks.plist"
+    ],
+    [
+      "BookmarksBar",
+      "Ars Technica",
+      "https://arstechnica.com/",
+      "252D3E5D-2B36-42F2-A655-8A1590662A19",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/Bookmarks.plist"
+    ],
+    [
+      "BookmarksBar",
+      "Cult of Mac",
+      "https://www.cultofmac.com/",
+      "A27FDC44-2A21-4448-B07A-190599424CCE",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/Bookmarks.plist"
+    ]
+  ]
+}

admin/test/results/safaribrowsing/safaribrowsing.safariCloudTabs.case1.20260830143822.json

@@ -0,0 +1,65 @@
+{
+  "metadata": {
+    "module_name": "safaribrowsing",
+    "artifact_name": "Safari iCloud Tabs (CloudTabs.db)",
+    "function_name": "safariCloudTabs",
+    "case_number": "case1",
+    "number_of_columns": 11,
+    "number_of_rows": 2,
+    "total_data_size_bytes": 444,
+    "media_checkins": 0,
+    "media_embedded_checkins": 0,
+    "input_zip_path": "admin/test/cases/data/safaribrowsing/testdata.safaribrowsing.safariCloudTabs.case1.zip",
+    "start_time": "2026-08-30T14:38:22.466191+00:00",
+    "end_time": "2026-08-30T14:38:22.476040+00:00",
+    "run_time_seconds": 0.00041222572326660156,
+    "last_commit": {
+      "hash": "3a6007b031dd3b7a749e75cb161e658d24260306",
+      "author_name": "Dielle De Noon",
+      "author_email": "dielleaiko@hotmail.com",
+      "date": "2026-08-30T10:30:56-04:00",
+      "message": "Corrected results for Recently Closed Tabs for Safari"
+    }
+  },
+  "headers": [
+    "Tab Title",
+    "URL",
+    "Device Name",
+    "Device UUID",
+    "Device Last Modified",
+    "Ephemeral Device",
+    "Pinned",
+    "Showing Reader",
+    "Reader Scroll Page",
+    "Tab UUID",
+    "Source File"
+  ],
+  "data": [
+    [
+      "/r/Memes the original since 2008",
+      "https://www.reddit.com/r/memes/",
+      "This\u2019s Mac",
+      "80B6064F-5AF9-4D65-BE9C-13ECFDD5DC24",
+      1613595906,
+      "",
+      "",
+      "",
+      0,
+      "5E01C263-426D-4605-A95E-7126DA274557",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/CloudTabs.db"
+    ],
+    [
+      "reddit: the front page of the internet",
+      "https://www.reddit.com/",
+      "This\u2019s Mac",
+      "80B6064F-5AF9-4D65-BE9C-13ECFDD5DC24",
+      1613595906,
+      "",
+      "",
+      "",
+      0,
+      "56E957DF-77B6-45A8-BE84-AA584AA4ADC8",
+      "tsk-data-volume-full/Users/thisisdfir/Library/Safari/CloudTabs.db"
+    ]
+  ]
+}