how to retrieve deleted safari history?

I am trying to figure out a way to discover if a history still exists somewhere on my computer of websites visited (from a specific day about three months ago). This is on a Macbook Pro, operating system is Sierra, and not using Time Machine or any other backup like that as far as I know. So far, I haven't tried much other than opening Finder, going to "Go to Folder" under "Go" from the finder menu bar, and then searching for "~/Library/Safari". Is it possible to use some type of software (like from http://sqlitebrowser.org), to see if it can read/translate some of the files in there (like History.db), and maybe that would show the IP addresses of the websites I was visiting that day on Safari at least?
Does that make any sense at all? Or is there an easier way of retrieving the deleted web surfing history from a specific day/time? Thanks.

Assuming the you haven't cleared the cache which might have erased the data from the DB file..you can use sqlite3 to look into the DB file and get the data you want..

I have sqlite3 installed through Homebrew, so I started it up with the following command in the terminal

Now you can query all of our visited items with

But since you want to look at specific date range, you would use the following modification

Change the month and day to match the day you want. In this case I'm looking for just the 27th of April..play around with the dates/times to get your desired result..

Thanks for your response! If you could help guide me along a little more that would be greatly appreciated, since this is all a little over my head to say the least. I just want to make sure I follow your steps correctly before I mess it up.
So first I go here: https://brew.sh and install this homebrew by basically just pasting the script they provide there into terminal.
Then I would go to this site here: https://www.sqlite.org to begin the downloading process for that version 3.
Then I would go to terminal, and put in that first code you wrote (sqlite3 ~/Library/Safari/History.db), and then secondly enter into terminal the bottom code you provided if I'm looking for a certain date range.
Is that pretty much all I need to do to see if it comes up with anything? What would that last code be if I am looking specifically just for April 28th (2017)?
Thanks again for your help and sorry about the extra questions.

No worries, I would just use the app from the link you provided (http://sqlitebrowser.org/) which will work faster..

So let me give you instructions with the app which will be a lot easier..I hope..

Once you install the DB Browser for SQLite application, launch it. On the main page, click on the Open Database button on top. In the window that will appear, hit SHIFT+CMD+g and in the window that appears, enter ~/Library/Safari and hit Go. Now open the History.db file there.

You will now see that the various portions of the app will populate with data from the database file. Click on the Execute SQL button and the enter the SQL statement (the SELECT command) from my previous post in the top portion and then click the Play button right above. The results will now appear in the bottom window and you should be able to scroll through it all..

Hope that makes it easier..

Or just like google says:

https://www.google.ca/search?client...&oe=UTF-8&gfe_rd=cr&ei=HDuBWY6qNfPe8AeV8ZaQCw

Almost the top hit says:

How do you recover deleted history on safari?

For Mac users of Safari:
Open Finder.
Click the “Go” menu.
Hold the option key and click “Library” when it appears.
Open the Safari folder.
Inside the folder, find the “WebpageIcons.db” file and drag it into your SQLite browser.
Click the “Browse Data” tab in the SQLite window.
Select “PageURL” from Table menu.

Click to expand...

DB Browser for SQLite download:
http://sqlitebrowser.org

At least it sounds fairly simple, but…

Good luck.







- Patrick
======

@Patrick:

Did you by chance miss what Ashwin stated in post #4?

I tried following the instructions from post #4 here. After I clicked on the Execute SQL button, I entered the code (the first SELECT command listed up above there on post #4):
select datetime(v.visit_time + 978307200, 'unixepoch', 'localtime') as date, i.domain_expansion, i.url from history_items i left join history_visits v on i.id = v.history_item order by date desc;

I actually did then receive results that included quite a bit of deleted safari history. However, I don't think this was a complete list of all deleted safari history, and unfortunately it didn't show anything for the date I was seeking (april 28th), but it did have history for several months prior to that, and then underneath that there was a ton more where the date just said null.

In the bottom window, it said this:
2265 rows returned in 49ms from: select datetime(v.visit_time + 978307200, 'unixepoch', 'localtime') as date, i.domain_expansion, i.url from history_items i left join history_visits v on i.id = v.history_item order by date desc;

Maybe I should have tried the code that just targeted that one specific date I need?
Or could the history that I'm looking for also be found in one of those other files besides the History.db file?

Going by the names of the DB files there it looks like History is the only one with that data. The others (AutoFillCorrections and WebpageIcons) seem unrelated (just by name alone)..

If your date range isn't there, you can play around with the second targeted statement and try narrowing it down. If that doesn't yield any results, then it isn't in the DB at least. It is possible that clearing the history likely removes it from the DB, so if you'd done that, then the information is lost..

Yea. Maybe for whatever reason some information got saved in there from certain days, but perhaps on that date I am looking for it is just gone. I assume that once I put in the command, I am just supposed to be browsing through the area below with the three columns (date, domain_domain expansion, and url), unless there is some other data like in that db schema table to the right side?

Anyways, so if I just want to play around with it, and search for that one day specifically, I could just try putting in this code?:
select datetime(v.visit_time + 978307200, 'unixepoch', 'localtime') as date, i.domain_expansion, i.url from history_items i left join history_visits v on i.id = v.history_item where date <= '2017-04-28 00:00:00' order by date desc;

With your addition, you're looking for data up to 4/27/2017. My variation with both the >= and <= had it looking only for data on 4/27/2017.

Ok. I think I get it maybe. So if I only want to look for April 28th, I would insert this into the code?:
where date >= '2017-04-28 00:00:00' and date <= '2017-04-29 00:00:00'

Correct. The syntax, if you will, is YEAR-MONTH-DAY HOUR:MIN:SECOND. So in this case, early 28th to early 29th in 24-hour time, that will cover 2017-04-28 00:00:01 -> 2017-04-28 23:59:59...