# Browsers forensics

### Browsing history / download artefacts

**Overview**

The web browsers related artefacts can be split in the following categories:

* User profile: web browsers, such as `Chronium`-based browsers and `Firefox`, implement a profile feature to store user's setttings, history, favourites, etc. The databases and files that store these information are usually stored under a user specific profile folder.
* History: web browsing history and download history.
* Cookies: web browsing cookies (session tokens).
* Cache: cache of resources downloaded from accessed websites (images, text content, `HTML`, `CSS`, `Javascript` files, etc.).
* Sessions: tabs and windows from a browsing session.
* Settings: configuration settings.

These files are often stored under `%LocalAppData%` (`%SystemDrive%:\Users\<USERNAME>\AppData\Local\`) and `%AppData%` (`%SystemDrive%:\Users\<USERNAME>\AppData\Roaming\`).

**Artefacts details**

| Name                                                                | Type               | Description                                                                                                                                                                                                                                                                                                                                                                                                              | Information / interpretation                                                                                                                                                                                                                  | Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Tool(s)                                                                                                                                                   |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |
| ------------------------------------------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------- |
| <p><code>NTUSER</code><br>-<br><code>TypedURLs</code></p>           | Web browsers usage | <p><code>URL</code> entered (typed, pasted, or auto-completed) in the <code>Internet Explorer (IE)</code> web browser search bar.<br><br>Web searches do not generate entries, only typing of an <code>URL</code> will.<br><br>Entries are added / updated in near real-time.</p>                                                                                                                                        | <p>The <code>URL</code> are stored as <code>url1</code> to <code>url\[N]</code> in inversed chronological order.<br><br>The last write timestamp of the key is thus the timestamp of visit of the most recently visited <code>URL</code>.</p> | <p>File: <code>%SystemDrive%:\Users\&#x3C;USERNAME>\NTUSER.dat</code><br>Registry key: <code>HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedURLs</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                                                                                                                           |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |
| `Microsoft Internet Explorer`                                       | Web browsers usage | <p><code>Microsoft Internet Explorer</code> artefacts.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p>                                                                                                                                                                                                          | -                                                                                                                                                                                                                                             | <p>History, downloads, cache, and cookies metadata in a <code>ESE</code> database:<br><code>%LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat</code><br>> History: <code>History</code> table<br>> Downloads: <code>iedownload</code> table.<br>> Cache: <code>content</code> table<br>> Cookies metadata: <code>Cookies</code> table.<br><br>Local files access, not necessarily through the webbrowser, may also appear in the <code>WebCacheV01.dat</code> database with the <code>file</code> <code>URI</code> scheme (such as <code>file:///\<DRIVE\_LETTER>:/folder/file</code>).<br><br>Cookies:<br><code>%AppData%\Microsoft\Windows\Cookies</code><br><br>Sessions:<br><code>%LocalAppData%\Microsoft\Internet Explorer\Recovery\*.dat</code></p> | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html)                                                               |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |
| <p><code>Microsoft Edge</code><br>(Legacy)</p>                      | Web browsers usage | <p><code>Microsoft Edge</code> (legacy version) artefacts.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p>                                                                                                                                                                                                      | -                                                                                                                                                                                                                                             | <p>User profile(s):<br><code>%LocalAppData%\Packages\Microsoft.MicrosoftEdge\_XXX\AC</code><br><br>History, downloads, cache, and cookies (file shared with <code>Microsoft Internet Explorer</code>):<br><code>%LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat</code><br><br>Cache:<br><code>%LocalAppData%\Packages\Microsoft.MicrosoftEdge\_XXX\AC#!XXX\MicrosoftEdge\Cache</code><br><br>Sessions:<br><code>%LocalAppData%\Packages\Microsoft.MicrosoftEdge\_XXX\AC\MicrosoftEdge\User\Default\Recovery\Active</code><br><br>Settings:<br><code>%LocalAppData%\Packages\Microsoft.MicrosoftEdge\_XXX\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\XXX\DBStore\spartan.edb</code></p>                                                         | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html)                                                               |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |
| <p><code>Microsoft Edge</code><br>(<code>Chronium</code>-based)</p> | Web browsers usage | <p><code>Microsoft Edge</code> (<code>Chronium</code>-based) artefacts.<br><br>Since Edge version <code>v79</code> (January 2020), <code>Microsoft Edge</code> uses a <code>Chronium</code> backend and shares similar artefacts to <code>Google Chrome</code>.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p> | -                                                                                                                                                                                                                                             | <p>User profile(s):<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Profile X>\*</code><br><em>With <code>X</code> ranging from one to n.</em><br><br>History:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\History</code><br><br>Cookies:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\Network\Cookies</code><br><br>Cache:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\Cache</code><br><br>Sessions:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\Sessions</code><br><br>Settings:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\Preferences</code></p> | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html) |
| `Google Chrome`                                                     | Web browsers usage | <p><code>Google Chrome</code> artefacts.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p>                                                                                                                                                                                                                        | -                                                                                                                                                                                                                                             | <p>User profile(s):<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Profile X>\*</code><br><em>With <code>X</code> ranging from one to n.</em><br><br>History:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\History</code><br><br>Cookies:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\Network\Cookies</code><br><br>Cache:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\Cache</code><br><br>Sessions:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\Sessions</code><br><br>Settings:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\Preferences</code></p> | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html) |
| `Mozilla Firefox`                                                   | Web browsers usage | <p><code>Mozilla Firefox</code> artefacts.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p>                                                                                                                                                                                                                      | -                                                                                                                                                                                                                                             | <p>User profile(s):<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\*</code><br><br>History, downloads, and bookmarks in a <code>SQLite</code> database:<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\places.sqlite</code><br><br>Cookies in a <code>SQLite</code> database:<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\cookies.sqlite</code><br><br>Cache:<br><code>%LocalAppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\cache2\*</code><br><br>Sessions:<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\sessionstorebackups\*</code><br><br>Settings:<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\prefs.js</code></p>    | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html)                                                               |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |

### Parsing

As stated, [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html) utility (`NirSoft_BrowsingHistoryView` KAPE module) can be used to parse a number of browsers artefacts to extract browsing history information. `BrowsingHistoryView` can be used either as a graphical application or as a command-line utility to export the parsing result (for instance in the CSV format).

```
# /HistorySource 3: Load history from the specified profiles folder (specified using /HistorySourceFolder).
# /HistorySourceFolder <USER_PROFILES_FOLDER> example: "C:\Users" or "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Users" (for shadow copy).
# /VisitTimeFilterType 1: Load history dating back to any time.
# /ShowTimeInGMT 1: Converts timestamps to UTC-0 (default to the local timezone).

browsinghistoryview.exe /HistorySource 3 /HistorySourceFolder "<USER_PROFILES_FOLDER>" /VisitTimeFilterType 1 /ShowTimeInGMT 1 /scomma <OUTPUT_CSV>
```

***

### References

<https://www.13cubed.com/downloads/windows\\_browser\\_artifacts\\_cheat\\_sheet.pdf>

<https://book.hacktricks.xyz/forensics/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts>

<https://www.nirsoft.net/utils/browsing\\_history\\_view.html>

<https://www.forensafe.com/blogs/typedurls.html>