OK, that's almost certainly NSKeyedArchiver. You'll need to "unpack" it before it makes any sense.
If you're happy using Python, we've open sourced a module which you can use to do the unpacking and then parse the data as a native python object, you can get it here: https://code.google.com/p/ccl-bplist/ (I'm happy to offer some guidance on the use of the module).
Otherwise PIP can unpack NSKeyedArchiver and then you can use XPath to parse it (PIP can generate the XPath in a nice point-and-click way, so you don't really need to know XPath to use it ). http://ccl-forensics.com/pip
↧