Browser Forensics

Browser Artifact

Common objects that browsers save:

1. Navigation history: user history
2. Autocomplete data: suggest based on most frequently searched keywords
3. Bookmarks: save website URL address
4. Extensions and add-ons: small software module for a specific purpose
5. Cache: photos or javascript files, improve loading time
6. Favicon: small icons in tabs
7. Browser session: store browser information since user open it and until they close it
8. Form data: data inside forms, saved by browser
9. Thumbnails: small images associated with a website

Artifact Path

Chrome

macOS   ~/Library/Application Support/Google/Chrome/Default/
Windows %LOCALAPPDATA%\Google\Chrome\User Data\Default\
Linux   ~/.config/google-chrome/Default/

Artifact	File Name	Notes
History	History (SQLite)	Visited URLs, downloads, etc.
Cookies	Cookies (SQLite)	Session info, auth tokens
Cache	Cache/ directory	Cached images, scripts
Login Data	Login Data (SQLite)	Saved passwords (encrypted)
Bookmarks	Bookmarks (JSON)	User bookmarks
Sessions	Sessions/	Open tabs, session states
Preferences	Preferences (JSON)	Settings & extensions info
Visited Tabs	Current Session, Last Session	Under Sessions/ folder

Firefox

macOS   ~/Library/Application Support/Firefox/Profiles/<profile>.default-release/
Windows %APPDATA%\Mozilla\Firefox\Profiles\<profile>.default-release\
Linux   ~/.mozilla/firefox/<profile>.default-release/

Artifact	File Name	Notes
History	places.sqlite (SQLite)	URLs, bookmarks
Downloads	downloads.sqlite (SQLite)	Older versions only
Cookies	cookies.sqlite (SQLite)	Session cookies, domains
Cache	cache2/ directory	Binary cached objects
Form Data	formhistory.sqlite	Form input auto-fill entries
Logins	logins.json (Encrypted)	Saved usernames/passwords
Sessions	sessionstore.jsonlz4	Open tabs & windows
Add-ons	extensions.json	Installed extensions info

Safari

macOS only.

~/Library/Safari/

Artifact	File Name	Notes
History	History.db (SQLite)	Browsing history
Downloads	Downloads.plist (XML/PLIST)	Downloaded file records
Bookmarks	Bookmarks.plist	Saved bookmarks
Cookies	/Cookies/Cookies.binarycookies	Requires parsing tool
Tabs/Windows	LastSession.plist, Tabs.plist	Open tabs in last session
Top Sites	TopSites.plist	Frequently visited websites

Tools

1. DB Browser: open sqlite files
2. Nirsoft: BrowsingHistoryView, ChromeCookiesView, ChromeCacheView

References

Hawk Eye Forensic