Browsers forensics
Browsing history / download artefacts
Overview
The web browsers related artefacts can be split in the following categories:
User profile: web browsers, such as
Chronium
-based browsers andFirefox
, implement a profile feature to store user's setttings, history, favourites, etc. The databases and files that store these information are usually stored under a user specific profile folder.History: web browsing history and download history.
Cookies: web browsing cookies (session tokens).
Cache: cache of resources downloaded from accessed websites (images, text content,
HTML
,CSS
,Javascript
files, etc.).Sessions: tabs and windows from a browsing session.
Settings: configuration settings.
These files are often stored under %LocalAppData%
(%SystemDrive%:\Users\<USERNAME>\AppData\Local\
) and %AppData%
(%SystemDrive%:\Users\<USERNAME>\AppData\Roaming\
).
Artefacts details
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Web browsers usage |
| The | File: | |
| Web browsers usage |
| - | History, downloads, cache, and cookies metadata in a | |
| Web browsers usage |
| - | User profile(s):
| |
| Web browsers usage |
| - | User profile(s):
| |
| Web browsers usage |
| - | User profile(s):
| |
| Web browsers usage |
| - | User profile(s):
|
Parsing
As stated, NirSoft's BrowsingHistoryView
utility (NirSoft_BrowsingHistoryView
KAPE module) can be used to parse a number of browsers artefacts to extract browsing history information. BrowsingHistoryView
can be used either as a graphical application or as a command-line utility to export the parsing result (for instance in the CSV format).
References
https://www.13cubed.com/downloads/windows_browser_artifacts_cheat_sheet.pdf
https://book.hacktricks.xyz/forensics/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts
https://www.nirsoft.net/utils/browsing_history_view.html
https://www.forensafe.com/blogs/typedurls.html
Last updated