Some macOS Forensics
macOS 12:
In `/System/Volumes/Data/Users/<USER>/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist`
You can find a key, which is intially not set. But will be set if the user deleted the browser history.
I saved the plist to a regular textfile before and after clearing the browser history. And compared the two with:
`diff prefernces.before.change.txt preferences.after.change.txt`
"ClearBrowsingDataLastIntervalUsed" => "all history"
This is an interesting key, unfortunately I was only able to find this in macOS 12.
Did someone else notice that key?