Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
When investigating user web activity as part of a forensic examination
During insider threat investigations to establish patterns of data exfiltration
When tracing user visits to malicious or policy-violating websites
For correlating browser activity with other forensic artifacts and timelines
When investigating phishing attacks to identify which links were clicked
Detection Gaps & Validation
Incognito/private mode leaves no history row. Chrome Incognito and Firefox Private Browsing do not write to History/places.sqlite. Absence of a URL is not proof it was not visited — pivot to network-side evidence.
Most-missed source: the SQLite WAL.History-wal/places.sqlite-wal (and -shm, rollback journals) hold recently committed and uncommitted records that the main DB lacks. Collect the WAL alongside the DB, or a checkpoint on open will silently merge/lose state. Deleted rows also survive in freelist/unallocated DB pages (recover with a SQLite record carver).
Epoch pitfalls: Chrome/Edge timestamps are microseconds since 1601-01-01 (/1000000 - 11644473600); Firefox is microseconds since 1970. Mixing them produces wildly wrong times.
Sync contamination: a signed-in profile can pull history/bookmarks from other devices, so a URL in the DB was not necessarily visited on this machine.
Anti-forensics: "Clear browsing data," DB file deletion, and timestamp edits. DPAPI-encrypted passwords/cookies require the user's master key.
Validate / cross-corroborate: confirm a visit with a second source — DNS resolver cache, proxy/firewall/SWG logs, SRUM network usage, and $MFT/Downloads entries for fetched files. Match a known value (download filename, referrer chain) rather than relying on a bare 200/row.
Prerequisites
Forensic image or access to user profile directories
SQLite3 for querying browser databases
Hindsight, BrowsingHistoryView, or DB Browser for SQLite
Knowledge of browser artifact file locations per OS
Python 3 with sqlite3 module for automated extraction
Understanding of Chrome, Firefox, and Edge storage formats
Step 2: Extract Chrome Browsing History and Downloads
# Query Chrome History database
sqlite3 /cases/case-2024-001/browser/chrome/History << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/chrome_history.csv
SELECT
urls.url,
urls.title,
datetime(urls.last_visit_time/1000000-11644473600, 'unixepoch') AS last_visit,
urls.visit_count,
urls.typed_count,
visits.transition & 0xFF AS transition_type
FROM urls
LEFT JOIN visits ON urls.id = visits.url
ORDER BY urls.last_visit_time DESC;
SQL
# Extract Chrome downloads
sqlite3 /cases/case-2024-001/browser/chrome/History << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/chrome_downloads.csv
SELECT
current_path,
tab_url AS source_url,
total_bytes,
datetime(start_time/1000000-11644473600, 'unixepoch') AS start_time,
datetime(end_time/1000000-11644473600, 'unixepoch') AS end_time,
state,
danger_type,
mime_type
FROM downloads
ORDER BY start_time DESC;
SQL
# Extract Chrome search terms
sqlite3 /cases/case-2024-001/browser/chrome/History << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/chrome_searches.csv
SELECT
term,
urls.url,
datetime(urls.last_visit_time/1000000-11644473600, 'unixepoch') AS search_time
FROM keyword_search_terms
JOIN urls ON keyword_search_terms.url_id = urls.id
ORDER BY urls.last_visit_time DESC;
SQL
Step 3: Extract Firefox Browsing History
# Query Firefox places.sqlite for history
sqlite3 /cases/case-2024-001/browser/firefox/places.sqlite << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/firefox_history.csv
SELECT
moz_places.url,
moz_places.title,
datetime(moz_historyvisits.visit_date/1000000, 'unixepoch') AS visit_date,
moz_places.visit_count,
moz_historyvisits.visit_type
FROM moz_places
JOIN moz_historyvisits ON moz_places.id = moz_historyvisits.place_id
ORDER BY moz_historyvisits.visit_date DESC;
SQL
# Extract Firefox bookmarks
sqlite3 /cases/case-2024-001/browser/firefox/places.sqlite << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/firefox_bookmarks.csv
SELECT
moz_bookmarks.title,
moz_places.url,
datetime(moz_bookmarks.dateAdded/1000000, 'unixepoch') AS date_added,
datetime(moz_bookmarks.lastModified/1000000, 'unixepoch') AS last_modified
FROM moz_bookmarks
JOIN moz_places ON moz_bookmarks.fk = moz_places.id
WHERE moz_bookmarks.type = 1
ORDER BY moz_bookmarks.dateAdded DESC;
SQL
# Extract Firefox form history (search terms, form fills)
sqlite3 /cases/case-2024-001/browser/firefox/formhistory.sqlite << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/firefox_forms.csv
SELECT
fieldname,
value,
timesUsed,
datetime(firstUsed/1000000, 'unixepoch') AS first_used,
datetime(lastUsed/1000000, 'unixepoch') AS last_used
FROM moz_formhistory
ORDER BY lastUsed DESC;
SQL
Step 4: Extract Cookies and Stored Credentials
# Extract Chrome cookies
sqlite3 /cases/case-2024-001/browser/chrome/Cookies << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/chrome_cookies.csv
SELECT
host_key,
name,
path,
datetime(creation_utc/1000000-11644473600, 'unixepoch') AS created,
datetime(expires_utc/1000000-11644473600, 'unixepoch') AS expires,
datetime(last_access_utc/1000000-11644473600, 'unixepoch') AS last_access,
is_secure,
is_httponly,
is_persistent
FROM cookies
ORDER BY last_access_utc DESC;
SQL
# Extract Firefox cookies
sqlite3 /cases/case-2024-001/browser/firefox/cookies.sqlite << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/firefox_cookies.csv
SELECT
host,
name,
path,
datetime(creationTime/1000000, 'unixepoch') AS created,
datetime(expiry, 'unixepoch') AS expires,
datetime(lastAccessed/1000000, 'unixepoch') AS last_access,
isSecure,
isHttpOnly
FROM moz_cookies
ORDER BY lastAccessed DESC;
SQL
# Note: Chrome Login Data is encrypted with DPAPI (Windows) or keychain (Mac)# Extract stored login URLs (passwords are encrypted)
sqlite3 /cases/case-2024-001/browser/chrome/"Login Data" << 'SQL'
.headers on
.mode csv
.output /cases/case-2024-001/analysis/chrome_logins.csv
SELECT
origin_url,
action_url,
username_value,
datetime(date_created/1000000-11644473600, 'unixepoch') AS date_created,
datetime(date_last_used/1000000-11644473600, 'unixepoch') AS date_last_used,
times_used
FROM logins
ORDER BY date_last_used DESC;
SQL
Step 5: Use Hindsight for Comprehensive Chrome Analysis
# Install Hindsight
pip install pyhindsight
# Run Hindsight against Chrome profile
hindsight -i "/cases/case-2024-001/browser/chrome/" \
-o /cases/case-2024-001/analysis/hindsight_report \
-f xlsx
# Hindsight automatically extracts:# - Browsing history with timestamps# - Downloads with source URLs# - Cookies with decryption (where possible)# - Cache records# - Local Storage entries# - Autofill data# - Saved passwords (encrypted)# - Preferences and extensions# - Session/tab recovery data# For JSONL output (easier to parse)
hindsight -i "/cases/case-2024-001/browser/chrome/" \
-o /cases/case-2024-001/analysis/hindsight_report \
-f jsonl
Key Concepts
Concept
Description
Chrome timestamp
Microseconds since January 1, 1601 (WebKit/Chrome epoch)
Firefox timestamp
Microseconds since January 1, 1970 (Unix epoch in microseconds)
Transition types
How a URL was accessed: typed (1), link (0), bookmark (1), redirect (5/6)
DPAPI encryption
Windows Data Protection API encrypting stored passwords and cookies
places.sqlite
Firefox combined history and bookmark database
SQLite WAL
Write-Ahead Log that may contain recently deleted browser records
Session restore
Browser data preserving open tabs across restarts
IndexedDB
Browser-based database that may contain web application data
NirSoft tool for viewing browser history across all browsers
ChromeCacheView
NirSoft tool for examining Chrome cache contents
MZCacheView
NirSoft tool for Firefox cache analysis
KAPE
Automated artifact collection including browser data
Autopsy
Full forensic platform with browser artifact ingest modules
Common Scenarios
Scenario 1: Phishing Investigation
Extract browser history around the reported phishing timeframe, identify the phishing URL that was visited, check downloads for malicious attachments, examine cookies for session tokens that may have been stolen, correlate with email header analysis.
Scenario 2: Data Exfiltration via Cloud Services
Search history for cloud storage URLs (Dropbox, Google Drive, OneDrive, Mega), examine downloads and uploads, check form history for file names entered, review cookies for active cloud service sessions during the investigation period.
Scenario 3: Policy Violation Investigation
Extract complete browsing history for the investigation period, categorize sites visited, identify access to prohibited content categories, document timestamps and visit duration, correlate with network proxy logs for verification.
Scenario 4: Malware Delivery Vector Analysis
Trace the chain of redirects leading to a drive-by download, examine the downloads database for the malware payload, check cache for exploit kit landing pages, identify the initial referrer URL that started the infection chain.
Output Format
Browser Forensics Summary:
User Profile: suspect (Windows 10)
Browsers Found: Chrome 120, Firefox 121, Edge 120
Chrome Analysis:
History Entries: 12,456
Downloads: 234
Saved Passwords: 67 sites (encrypted)
Cookies: 3,456
Bookmarks: 89
Firefox Analysis:
History Entries: 5,678
Form Entries: 234
Bookmarks: 45
Cookies: 1,234
Suspicious Findings:
- Visited known phishing URL at 2024-01-15 14:32 UTC
- Downloaded "invoice_update.exe" from suspicious domain
- Cloud storage (mega.nz) accessed 15 times in 2-hour window
- Search queries: "how to encrypt files", "secure file transfer"
Reports:
Chrome History: /analysis/chrome_history.csv
Firefox History: /analysis/firefox_history.csv
Full Report: /analysis/hindsight_report.xlsx
