# Browsers forensics

### Browsing history / download artefacts

**Overview**

The web browsers related artefacts can be split in the following categories:

* User profile: web browsers, such as `Chronium`-based browsers and `Firefox`, implement a profile feature to store user's setttings, history, favourites, etc. The databases and files that store these information are usually stored under a user specific profile folder.
* History: web browsing history and download history.
* Cookies: web browsing cookies (session tokens).
* Cache: cache of resources downloaded from accessed websites (images, text content, `HTML`, `CSS`, `Javascript` files, etc.).
* Sessions: tabs and windows from a browsing session.
* Settings: configuration settings.

These files are often stored under `%LocalAppData%` (`%SystemDrive%:\Users\<USERNAME>\AppData\Local\`) and `%AppData%` (`%SystemDrive%:\Users\<USERNAME>\AppData\Roaming\`).

**Artefacts details**

| Name                                                                | Type               | Description                                                                                                                                                                                                                                                                                                                                                                                                              | Information / interpretation                                                                                                                                                                                                                  | Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Tool(s)                                                                                                                                                   |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |
| ------------------------------------------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------- |
| <p><code>NTUSER</code><br>-<br><code>TypedURLs</code></p>           | Web browsers usage | <p><code>URL</code> entered (typed, pasted, or auto-completed) in the <code>Internet Explorer (IE)</code> web browser search bar.<br><br>Web searches do not generate entries, only typing of an <code>URL</code> will.<br><br>Entries are added / updated in near real-time.</p>                                                                                                                                        | <p>The <code>URL</code> are stored as <code>url1</code> to <code>url\[N]</code> in inversed chronological order.<br><br>The last write timestamp of the key is thus the timestamp of visit of the most recently visited <code>URL</code>.</p> | <p>File: <code>%SystemDrive%:\Users\&#x3C;USERNAME>\NTUSER.dat</code><br>Registry key: <code>HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedURLs</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                                                                                                                           |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |
| `Microsoft Internet Explorer`                                       | Web browsers usage | <p><code>Microsoft Internet Explorer</code> artefacts.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p>                                                                                                                                                                                                          | -                                                                                                                                                                                                                                             | <p>History, downloads, cache, and cookies metadata in a <code>ESE</code> database:<br><code>%LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat</code><br>> History: <code>History</code> table<br>> Downloads: <code>iedownload</code> table.<br>> Cache: <code>content</code> table<br>> Cookies metadata: <code>Cookies</code> table.<br><br>Local files access, not necessarily through the webbrowser, may also appear in the <code>WebCacheV01.dat</code> database with the <code>file</code> <code>URI</code> scheme (such as <code>file:///\<DRIVE\_LETTER>:/folder/file</code>).<br><br>Cookies:<br><code>%AppData%\Microsoft\Windows\Cookies</code><br><br>Sessions:<br><code>%LocalAppData%\Microsoft\Internet Explorer\Recovery\*.dat</code></p> | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html)                                                               |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |
| <p><code>Microsoft Edge</code><br>(Legacy)</p>                      | Web browsers usage | <p><code>Microsoft Edge</code> (legacy version) artefacts.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p>                                                                                                                                                                                                      | -                                                                                                                                                                                                                                             | <p>User profile(s):<br><code>%LocalAppData%\Packages\Microsoft.MicrosoftEdge\_XXX\AC</code><br><br>History, downloads, cache, and cookies (file shared with <code>Microsoft Internet Explorer</code>):<br><code>%LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat</code><br><br>Cache:<br><code>%LocalAppData%\Packages\Microsoft.MicrosoftEdge\_XXX\AC#!XXX\MicrosoftEdge\Cache</code><br><br>Sessions:<br><code>%LocalAppData%\Packages\Microsoft.MicrosoftEdge\_XXX\AC\MicrosoftEdge\User\Default\Recovery\Active</code><br><br>Settings:<br><code>%LocalAppData%\Packages\Microsoft.MicrosoftEdge\_XXX\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\XXX\DBStore\spartan.edb</code></p>                                                         | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html)                                                               |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |
| <p><code>Microsoft Edge</code><br>(<code>Chronium</code>-based)</p> | Web browsers usage | <p><code>Microsoft Edge</code> (<code>Chronium</code>-based) artefacts.<br><br>Since Edge version <code>v79</code> (January 2020), <code>Microsoft Edge</code> uses a <code>Chronium</code> backend and shares similar artefacts to <code>Google Chrome</code>.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p> | -                                                                                                                                                                                                                                             | <p>User profile(s):<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Profile X>\*</code><br><em>With <code>X</code> ranging from one to n.</em><br><br>History:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\History</code><br><br>Cookies:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\Network\Cookies</code><br><br>Cache:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\Cache</code><br><br>Sessions:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\Sessions</code><br><br>Settings:<br><code>%LocalAppData%\Microsoft\Edge\User Data\&#x3C;Default | Profile X>\Preferences</code></p> | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html) |
| `Google Chrome`                                                     | Web browsers usage | <p><code>Google Chrome</code> artefacts.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p>                                                                                                                                                                                                                        | -                                                                                                                                                                                                                                             | <p>User profile(s):<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Profile X>\*</code><br><em>With <code>X</code> ranging from one to n.</em><br><br>History:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\History</code><br><br>Cookies:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\Network\Cookies</code><br><br>Cache:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\Cache</code><br><br>Sessions:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\Sessions</code><br><br>Settings:<br><code>%LocalAppData%\Google\Chrome\User Data\&#x3C;Default  | Profile X>\Preferences</code></p> | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html) |
| `Mozilla Firefox`                                                   | Web browsers usage | <p><code>Mozilla Firefox</code> artefacts.<br><br>For more information: <a href="https://github.com/Qazeer/InfoSec-Notes/blob/master/Common/Browsers_forensics.md">Browsers forensics note</a>.</p>                                                                                                                                                                                                                      | -                                                                                                                                                                                                                                             | <p>User profile(s):<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\*</code><br><br>History, downloads, and bookmarks in a <code>SQLite</code> database:<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\places.sqlite</code><br><br>Cookies in a <code>SQLite</code> database:<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\cookies.sqlite</code><br><br>Cache:<br><code>%LocalAppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\cache2\*</code><br><br>Sessions:<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\sessionstorebackups\*</code><br><br>Settings:<br><code>%AppData%\Mozilla\Firefox\Profiles\&#x3C;ID>.default-release\prefs.js</code></p>    | [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html)                                                               |                                                                                                          |                                                                                                                |                                                                                                         |                                                                                                            |                                   |                                                                                             |

### Parsing

As stated, [`NirSoft's BrowsingHistoryView`](https://www.nirsoft.net/utils/browsing_history_view.html) utility (`NirSoft_BrowsingHistoryView` KAPE module) can be used to parse a number of browsers artefacts to extract browsing history information. `BrowsingHistoryView` can be used either as a graphical application or as a command-line utility to export the parsing result (for instance in the CSV format).

```
# /HistorySource 3: Load history from the specified profiles folder (specified using /HistorySourceFolder).
# /HistorySourceFolder <USER_PROFILES_FOLDER> example: "C:\Users" or "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Users" (for shadow copy).
# /VisitTimeFilterType 1: Load history dating back to any time.
# /ShowTimeInGMT 1: Converts timestamps to UTC-0 (default to the local timezone).

browsinghistoryview.exe /HistorySource 3 /HistorySourceFolder "<USER_PROFILES_FOLDER>" /VisitTimeFilterType 1 /ShowTimeInGMT 1 /scomma <OUTPUT_CSV>
```

***

### References

<https://www.13cubed.com/downloads/windows\\_browser\\_artifacts\\_cheat\\_sheet.pdf>

<https://book.hacktricks.xyz/forensics/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts>

<https://www.nirsoft.net/utils/browsing\\_history\\_view.html>

<https://www.forensafe.com/blogs/typedurls.html>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.qazeer.io/dfir/common/browsers_forensics.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.