Plist (Property List)
Definition
A structured data format native to Apple operating systems, available in XML and binary variants. iOS uses plist files to store app preferences, account credentials, configuration data, and small records such as recently visited locations or Wi-Fi networks.
- Platform
- Apple operating systems (iOS, macOS)
- File variants
- XML and binary
- Typical contents
- App preferences, account credentials, config data
- Forensic examples
- Recent locations, saved Wi-Fi networks
Common questions
Why do examiners specifically look for binary plist files?+
Binary plists are not human-readable in a raw text viewer, so an examiner needs a parser to convert them before the stored preferences, credentials, or location records inside become visible and usable as evidence.
What is the practical difference between the XML and binary plist formats?+
Both encode the same key-value structure, but binary plist is more compact and faster to parse, which is why iOS favors it for system and app data, while XML plist is easier to inspect manually and appears more in developer-facing configuration files.
Related terms
- App Sandbox Container
- An isolated directory assigned to each app on iOS under /var/mobile/Containers/Data/Application/<UUID>/. The container holds all of the app's Documents, Library, and tmp...
- iOS Keychain
- A hardware-backed secure credential store on iOS devices that holds passwords, authentication tokens, and cryptographic keys. Keychain items are encrypted with keys...
- NAND Flash
- The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...
- SQLite
- A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...
- Wear-Leveling
- A flash storage controller behavior that distributes write operations across all available memory cells to prevent premature failure of any single cell....