Viewing Mac OS X Parental Control files

One of the many signs that OS X parental controls are half-baked is that Snow Leopard's default log tool doesn't actually .. you know ... display the site history. It's not just Snowie, this is old incompetence.

I'd wondered if there was any way to actually view the sites visited; perhaps a way to load the records in another tool. My Google searches found nothing, but a question on the most illustrious superuser.com site brought a comprehensive answer.

The answer was excellent even though I started out with a misleading question ...

OS X stores Parental Control logs in /Library/Application Support/Apple/ParentalControls/Users/[username]/year/month with the extension .data.

For example, 15-usage.data contains usage data for the 15 day of a month.

The log files are system read/write only. To access them one must change permissions or use terminal.

I would like to be able browse these files. In an Apple discussion I found a reference to using a "SQL" add on for Firefox to browse them. I guessed this meant SQLite Manager for Firefox, but I the SQLite browsers I've tried can't open the file.

The file is binary, but in a text editor it shows typical Apple .plist header.

I suspect a form of SQLite, or Core Data (which I think can use SQLite).

Does anyone have information on how to browse these files?

My question was misleading because the date-specific .data files are a red herring. The real data is in /events.data ....

osx - How can I view Mac OS X Parental Control files with format .data? - Super User (answer from Daniel Beck)

These date-specific files are regular binary plist files created from a Core Data object graph. Open with Xcode 4 or Property List Editor (comes with Xcode 3), or any text editor after you convert it to XML using plutil -convert xml1 filename.data -o filename-xml.plist in Terminal. The content is pretty much useless though, unless you know how to load it again.

Much more interesting is /Library/Application Support/Apple/ParentalControls/Users/username/events.data. This contains the user-specific applications, web sites and chat protocols in a SQLite container format. Open e.g. using Base, other tools here and here. The date columns are seconds since a date and time in early 2000.

For me, comparison of the GUI value and experimentation showed the 0 value to be Jan 2, 2000, at 2:00:00 AM. Dates shown are May 18 according to the UI. I suggest you focus on this file only; I believe the others are simply helper files for internal data structures.

Incidentally, Daniel Beck lives in Germany has 770 answers on superuser.