How can I view Mac OS X Parental Control files with format .data?

Question

OS X stores Parental Control logs in /Library/Application Support/Apple/ParentalControls/Users/[username]/year/month with the extension .data.

For example, 15-usage.data contains usage data for the 15 day of a month.

The log files are system read/write only. To access them one must change permissions or use terminal.

I would like to be able browse these files. In an Apple discussion I found a reference to using a "SQL" add on for Firefox to browse them. I guessed this meant SQLite Manager for Firefox, but I the SQLite browsers I've tried can't open the file.

The file is binary, but in a text editor it shows typical Apple .plist header.

I suspect a form of SQLite, or Core Data (which I think can use SQLite).

Does anyone have information on how to browse these files?

---

PS. It's hard to search on this, because both Bing and Google treat ".data" as "data", even when I use quotes. Also, as to why I want to do this ... I am working with a special needs adolescent with cognitive impairments, teaching him to develop self-monitoring skills. We review the logs together using OS X Parental Controls log viewer. Unfortunately Apple's viewer tool is broken (can't resize so can't view URLs) and has been broken through several OS revisions. Note this log cannot be viewed using Console.

Solution

These date-specific files are regular binary plist files created from a Core Data object graph. Open with Xcode 4 or Property List Editor (comes with Xcode 3), or any text editor after you convert it to XML using plutil -convert xml1 filename.data -o filename-xml.plist in Terminal. The content is pretty much useless though, unless you know how to load it again.

---

Much more interesting is /Library/Application Support/Apple/ParentalControls/Users/username/events.data

This contains the user-specific applications, web sites and chat protocols in a SQLite container format. Open e.g. using Base, other tools here and here.

The date columns are seconds since a date and time in early 2000. For me, comparison of the GUI value and experimentation showed the 0 value to be Jan 2, 2000, at 2:00:00 AM. Dates shown are May 18 according to the UI.

I suggest you focus on this file only; I believe the others are simply helper files for internal data structures.

Comments

[HikeMike]

Wouldn't the browser history suffice if you're working with and not against the user?

[John Faughnan]

So I was looking at the wrong file! Thank you Daniel, that is an exceptional answer.