extracting-browser-history-artifacts

name	extracting-browser-history-artifacts
description	Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity. Use when working with extracting browser history artifacts.
domain	cybersecurity
tags	["forensics","browser-forensics","chrome","firefox","edge","web-history","artifact-extraction"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Extracting Browser History Artifacts

Overview

Cybersecurity skill for extracting browser history artifacts. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "extracting browser history artifacts"

• "Extract and analyze browser history, cookies, cache, downloads, and bookmarks fr"

• When investigating user web activity as part of a forensic examination

• During insider threat investigations to establish patterns of data exfiltration

• When tracing user visits to malicious or policy-violating websites

• For correlating browser activity with other forensic artifacts and timelines

• When investigating phishing attacks to identify which links were clicked

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Forensic image or access to user profile directories
• SQLite3 for querying browser databases
• Hindsight, BrowsingHistoryView, or DB Browser for SQLite
• Knowledge of browser artifact file locations per OS
• Python 3 with sqlite3 module for automated extraction
• Understanding of Chrome, Firefox, and Edge storage formats

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}