10 days ago I was awarded an interview at my dream medical school, and immediately signed up for a time slot on their website. However, I recently got an email that I actually DIDNT sign up for a time slot and I’ve therefore lost the opportunity. I must have failed to click confirm!

So my question is, how do I prove that I visited the sign-up page on the 12 or 13th of December? I’ve checked my browser history for Safari and Firefox from those days, but for some reason the website is not in there—is it possible that it got inadvertently deleted? I know that I visited the pages and that I was not in private browsing mode.

A couple of specific questions: 1. What are your suggestions in terms of finding the missing browsing history in my Mac? I’m running OS Mountain Lion and I didn’t have Time Machine running. I have found my history.plist file, but it seems really short and only seems to have websites that visited in the past couple days.

  1. Is there any way that cookies might help me? I unfortunately don’t think that the university’s site collects them, and I didn’t see the site in my safari cookies, but might this be an avenue to pursue?

  2. Is there anything that the university might be able to do to check website activity? I’ve sent them my IP address, but I’m worried that it may have changed since 10 days ago and won’t match. Is there anything else I can ask them to do?

  3. Anything else in terms of proving that I thought I had signed up? The only thing I have right now is that I entered the interview time slot into my iCalendar as soon as I signed up, so the time stamp on the item in my calendar matches the day.

I appreciate any help you can give, and let me know if I should provide any more information! I desperately want the chance to interview at this school!

  • 5
    Why would "I visited your site" make a difference? – Thorbjørn Ravn Andersen Dec 23 '18 at 11:54
  • Thank you very much for your responses! My original question remains un-answered! – Brown4Barber Dec 23 '18 at 15:01
  • @Allan or because it was visited later. Newer history items override older items in the list where the URL is the same, at least in Safari. – grg Dec 23 '18 at 15:01
  • 1
    It could be, but I'm not sure how you could check. In Safari's History page (⌘Y), have you tried searching for the page and seeing what date it says? I don't know if it's possible to get it back but I'll check Safari's history database to see if it keeps the record. However, all of this is easily faked and I don't think this makes for a valid case of proving a visit — I don't think it's ever possible to prove without their assistance; see the first comment. – grg Dec 23 '18 at 15:04
  • 1
    Hope your applying to lots of other places. Life's kind of like that. You could download Find Any File and search for all files with the web domain of the school. example: myschool.edu – historystamp Dec 23 '18 at 20:38

10 days ago...immediately signed up for a time slot on their website...how do I prove that I visited the sign-up page on the 12 or 13th of December?


Safari keeps history in a database that's capped at 80M. That's quite literally a metric ton of browsing you would have to do in the span of 10 days for the history to be over written. If you're not seeing it in your history, and especially if there are older entries, it wasn't deleted from your history, it just simply isn't there.

There are two more places you can look:

  • Cookies - ~/Library/Cookies
  • Cache - ~/Libary/Caches/com.apple.Safari


If the site you went to had a form that you were filling out, chances are they were using cookies (if just to identify your session). Search in your cookies cache directory for anything that potentially matches the site you were on. Listing this directory will show all the cookies stored in your user profile:

$ ls ~/Library/Cookies


You can search the Caches to see if anything was stored during that time. Using a similar method to the link above to search for cookies, create a text file called commands.txt (in your caches directory) with the following:

.mode csv
.once caches.txt
select time_stamp, request_key from cfurl_cache_response where time_stamp BETWEEN date('2018-12-11') AND date('2018-012-14');

Then issue the command:

$ sqlite3 Cache.db < commands.txt

If there's anything in that time period that matches your site, then you have "evidence" that you were there.


I don't see how this can help you in your situation. This data is useful if a manager was trying to prove that you were somewhere (a website) where/when you shouldn't have been, for example. However, you being at a particular website at a particular time doesn't negate the fact that the required task wasn't completed.

This is like standing in line for days to be the first to buy the very first iPhone ever made only to not pay for it. It doesn't matter that you were there and you may even have pictures of you holding it; you didn't do the critical part and actually complete the transaction.

  • as you conclude all the forensic work leads to nothing. Even if you find a proof of data send, as long the other site does not confirm the reception it is worthless. – Ruskes Dec 24 '18 at 2:11
  • Thank you very much @Allan! I’m just doing the most I can to help my case and crossing my fingers that somebody understands. I’ll check out those options! – Brown4Barber Dec 25 '18 at 13:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .