Browser Forensics

A comprehensive guide to extracting and analyzing browser artifacts across all major browsers and operating systems.

Quick Reference

Artifact Types

• Navigation History: User visits to websites
• Autocomplete Data: Search suggestions
• Bookmarks: Saved sites
• Extensions/Add-ons: Installed browser plugins
• Cache: Stored web content (images, JS files)
• Logins: Stored credentials
• Favicons: Website icons
• Sessions: Open browser sessions
• Downloads: Downloaded file records
• Form Data: Autofill information
• Thumbnails: Website preview images
• Custom Dictionary: User-added words

Firefox

Profile Locations

~/.mozilla/firefox/

/Users/$USER/Library/Application Support/Firefox/Profiles/

%userprofile%\AppData\Roaming\Mozilla\Firefox\Profiles\

Profile Discovery

# Find Firefox profiles
cat ~/.mozilla/firefox/profiles.ini | grep -E "^(Path|Default)="

Key Files in Profile Directory

Common Queries

# Extract browsing history
sqlite3 places.sqlite "SELECT datetime(visit_date/1000000000, 'unixepoch'), url FROM moz_historyvisits h JOIN moz_places p ON h.place_id = p.id ORDER BY visit_date DESC LIMIT 100;"

# Extract downloads
sqlite3 places.sqlite "SELECT datetime(last_modified_date/1000000000, 'unixepoch'), url, filename FROM moz_downloads;"

# Check anti-phishing settings
grep 'browser.safebrowsing' prefs.js

Password Decryption

# Install firefox_decrypt
pip install firefox_decrypt

# Decrypt saved passwords
firefox_decrypt --profile /path/to/profile

# Brute force master password
./scripts/firefox-brute.sh /path/to/passwords.txt /path/to/profile

Google Chrome

Profile Locations

~/.config/google-chrome/

/Users/$USER/Library/Application Support/Google/Chrome/

C:\Users\XXX\AppData\Local\Google\Chrome\User Data\

Profile Structure

Profiles are in

Default/

Profile 1/

Profile 2/

Key Files

Common Queries

# Extract browsing history
sqlite3 History "SELECT datetime(last_visit_time/1000000-11644473600, 'unixepoch'), url, title FROM urls ORDER BY last_visit_time DESC LIMIT 100;"

# Extract downloads
sqlite3 History "SELECT datetime(last_visit_time/1000000-11644473600, 'unixepoch'), url, filename FROM downloads;"

# Check anti-phishing settings
grep 'safebrowsing' ~/Library/Application\ Support/Google/Chrome/Default/Preferences

Transition Types (History)

Microsoft Edge

Data Locations

C:\Users\XX\AppData\Local\Packages\Microsoft.MicrosoftEdge_XXX\AC

C:\Users\XX\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

C:\Users\XX\AppData\Local\Packages\Microsoft.MicrosoftEdge_XXX\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\XXX\DBStore\spartan.edb

C:\Users\XXX\AppData\Local\Packages\Microsoft.MicrosoftEdge_XXX\AC#!XXX\MicrosoftEdge\Cache

C:\Users\XX\AppData\Local\Packages\Microsoft.MicrosoftEdge_XXX\AC\MicrosoftEdge\User\Default\Recovery\Active

Analysis Tools

• ESEDatabaseView: For WebCacheV01.dat and spartan.edb
• IECacheView: For cache inspection

Safari (macOS)

Data Location

/Users/$User/Library/Safari/

Key Files

Common Queries

# Extract browsing history
sqlite3 History.db "SELECT datetime(visit_time+978307200, 'unixepoch'), url FROM history_visits v JOIN history_items i ON v.history_item = i.id ORDER BY visit_time DESC LIMIT 100;"

# Check anti-phishing settings
defaults read com.apple.Safari WarnAboutFraudulentWebsites
# Returns 1 if enabled

Opera

Data Location

/Users/$USER/Library/Application Support/com.operasoftware.Opera/

Opera uses the same SQLite format as Chrome for history and downloads.

Anti-Phishing Check

grep 'fraud_protection_enabled' Preferences
# Look for "true" value

Internet Explorer 11

Data Locations

%userprofile%\Appdata\Local\Microsoft\Windows\WebCache\WebcacheVX.data

%userprofile%\Appdata\Local\Microsoft\Windows\Temporary Internet Files\

%userprofile%\Appdata\Roaming\Microsoft\Windows\Cookies

%userprofile%\Appdata\Roaming\Microsoft\Windows\IEDownloadHistory

%userprofile%\Appdata\Local\Microsoft\Windows\History

NTUSER.DAT\Software\Microsoft\InternetExplorer\TypedURLs

Analysis Tools

• ESEDatabaseView: For WebCacheVX.data
• IECacheView: For cache inspection
• IECookiesView: For cookies
• BrowsingHistoryView: For history
• photorec: For deleted data recovery

Registry Queries

# Extract typed URLs
reg query "HKCU\Software\Microsoft\Internet Explorer\TypedURLs"
reg query "HKCU\Software\Microsoft\Internet Explorer\TypedURLsTime"

SQLite Recovery

Both Chrome and Firefox use SQLite databases. Deleted entries can be recovered using:

• sqlparse: https://github.com/padfoot999/sqlparse
• sqlparse_gui: https://github.com/mdegrazia/SQLite-Deleted-Records-Parser/releases

# Recover deleted records
python sqlparse.py -i places.sqlite -o recovered_records.txt

Recommended Tools

Workflow Recommendations

1. Identify the browser and OS from the investigation context
2. Locate profile directories using the paths above
3. Extract SQLite databases to a working directory (don't modify originals)
4. Query databases for relevant artifacts
5. Check anti-phishing settings to understand security posture
6. Recover deleted data using sqlparse if needed
7. Decrypt credentials using appropriate tools
8. Document findings with timestamps and sources

Scripts

Use the bundled scripts for common tasks:

• scripts/extract-browser-history.sh

  - Extract history from any browser

• scripts/check-antiphishing.sh

  - Check anti-phishing across all browsers

• scripts/firefox-brute.sh

  - Brute force Firefox master password

Run with

--help