Forensicswiki.org has moved to this site, forensicswiki.xyz. For information, please join the Google Group forensicswiki-reborn
Converting Binary Plists
Binary plists are the files that Apple products use to store information. The easiest way to view them is to convert them to XML. Note that binary data in XML plist are converted in base64 and therefore strings in the binary data are not directly visible.
plutil on a Windows PC is stored in:
C:\Program Files (x86)\Common Files\Apple\Apple Application Support
Which can be added to the PATH in Environmental variables so plutil can be run from anywhere If you could like to copy out the plutil executable to another directory it requires a number of DLL's to function. These dlls are: ASL, CFNetwork, CoreFoundation, Foundation, icudt46, libdispatch, libicuin, libicuuc, libtidy, libxml2, objc, ptheadVC2, SQLite3 and zlib. These are all found in the Apple Application Support folder along with plutil.exe.
To convert Binary plists to XML run the command:
plutil -convert xml1 file.plist
Or with libplist
plutil -i file.plist > file.xml.plist