Web caches store copies of documents the user has accessed on the internet in order to reduce server access time when visiting that site again. The information contained inside web caches can help an investigator prove a crime was committed, build a timeline of events, and prove intent.
You can use MacForensicsLab's Salvage function to salvage the contents of these folders and show the cached information. This will show you websites that have been browsed who's files have not been over-written as well as present cache files that have not been flushed.
- The default web browser in Mac OS X is Safari. The Safari web cache is located: ~/Library/Caches/Safari
- The default storage location for Firefox's web cache is: ~/Users/"USERNAME"/Library/Caches/Firefox/
Profiles/"COMPUTERCODE.default"/Cache
There are a large number of other folders contained within the ~/Users/"USERNAME"/Library/Cache folder that may be of interest for investigators also. They can be viewed using the same process as the web caches.
