How to decode a Bookmark in a Property List

Many Property Lists in macOS now contain chunks of Base-64 text sandwiched between <data> and </data> markup that may seem impossible to decode. In most cases, those are Bookmarks, a close relative of the Finder Alias, and contain potentially useful information about a file. You’ll find these in shared file lists saved in .sfl, .sfl2 and .sfl3 files in ~/Library/Application Support/com.apple.sharedfilelist/, in Shortcuts, and elsewhere.

Although they’re just property lists, trying to make sense of them isn’t simple, as they don’t contain any file names or paths, just inscrutable UUIDs and chunks of gibberish text that appear to be binary encoded in Base-64. Here I’ll show you how to decode those Bookmarks and resolve them to discover what those Property Lists contain.

Bookmarks are a variant of Finder Aliases, introduced in System 7, over 30 years ago in 1991. From the outset, Aliases have been presented as opaque data structures handled by the system. Although apps have been able to obtain information from them, Apple hasn’t intended any more general access to the data they contain. Bookmarks are a generalisation of Aliases introduced in OS X 10.6, and have been used extensively inside macOS and applications since at least Mavericks 10.9 over ten years ago.

Prior to macOS Sierra, Finder Aliases (and some Bookmarks) were usually large, typically over 1 MB, because they contained icons and other data. Early releases of Sierra, even 10.12.1, didn’t always work properly with the new compact Bookmark and Alias formats introduced then, but they have since become widespread and generally fully compatible with the system and apps. If you remember struggling with Aliases, it’s probably from that time of transition. The current Alias format is typically around 1 KB, making them almost as efficient in terms of storage as symbolic links, although macOS continues to use symlinks rather than Aliases in many places, particularly where paths have to be resolved by commands and scripts.

Open one of those Property Lists in a suitable text editor like BBEdit, and find an encoded Bookmark within it. Open Precize, and from its Window menu use the Open Resolver command to display a new resolver window.

Copy the whole of the encoded Bookmark, from immediately after <data> to just before </data>, and paste that text into the upper text box in the resolver. When you click on the Analyse button, Precize will display the Bookmark in the lower text view in three different formats: first, as the content fields in the Bookmark, then as hex raw data, and finally by its table of contents.

Click on the Resolve button and Precize shows the path to the file both as a normal URL and using the volfs file system, giving its inode number. If the Bookmark has been successfully resolved, the Preview button shows that file in a QuickLook preview, and you can see the file in a Finder window using the Reveal in Finder button.

Among the more useful data resulting from a file being analysed are:

_NSURLPathKey gives the full path to the file,
_NSURLBookmarkURLStringKey gives the file’s full URL,
NSURLCreationDateKey gives the file’s creation timestamp,
NSURLIsRegularFileKey indicates whether it’s a normal file,
NSURLIsPackageKey indicates whether it’s a package rather than a file,
_NSURLBookmarkSecurityScopeCryptoKeyKey is used if this is a Security-Scoped Bookmark, most used with sandboxed apps.

Precize does a great deal more than that. Its main window displays lots of information about files, and will generate a Bookmark for any file you open in the app.

So now you know how to decode and resolve those chunks of Base-64 data in Property Lists, to discover their contents.