Browser Forensics Cheat Sheet

What it is

Web browsers keep a per-user profile made of SQLite databases, JSON files and caches. Chromium-based browsers (Google Chrome, Microsoft Edge since 2020, Brave, Opera, Vivaldi) share the same file layout, so one method covers them all. Firefox uses its own set of SQLite databases. Together they are usually the richest record of what a user did online: pages visited, search terms, downloads, logins, form entries and open tabs.

Legacy Internet Explorer 10/11 and the original EdgeHTML-based Edge stored history in an ESE database, WebCacheV01.dat, which still turns up on older or upgraded systems.

Location

Browser	Profile path	Key files
Chrome	`%LOCALAPPDATA%\Google\Chrome\User Data\<Profile>\` (`Default`, `Profile 1`…)	`History`, `Network\Cookies`, `Login Data`, `Web Data`, `Top Sites`, `Shortcuts`, `Sessions\`, `Preferences`, `Cache\Cache_Data\`
Edge (Chromium)	`%LOCALAPPDATA%\Microsoft\Edge\User Data\<Profile>\`	Same files as Chrome, plus `Collections\collectionsSQLite`
Firefox	`%APPDATA%\Mozilla\Firefox\Profiles\<random>.<name>\`	`places.sqlite`, `cookies.sqlite`, `formhistory.sqlite`, `favicons.sqlite`, `sessionstore.jsonlz4`, `logins.json`
Firefox cache	`%LOCALAPPDATA%\Mozilla\Firefox\Profiles\<profile>\cache2\`	Cached HTTP objects
IE 10/11, legacy Edge	`%LOCALAPPDATA%\Microsoft\Windows\WebCache\WebCacheV01.dat`	ESE database (history, cookies, cache index)
XP-era IE	`...\Local Settings\History\History.IE5\index.dat`	Binary index files

Since Chrome 96 the cookie database lives in the Network subfolder. Firefox runs its databases in WAL mode, so copy places.sqlite-wal and -shm along with the main file (SQLite WAL); Chromium databases often have a -journal companion file.

What it proves

Browsing: a URL was loaded in a given profile, how often, and whether the address was typed.
Searches: search terms (Chromium keyword_search_terms, Shortcuts; Firefox moz_inputhistory and search URLs).
Downloads: source URL, referrer, local save path, size, start and end time and whether the file was opened (Chromium).
Accounts and sessions: saved logins (user names; passwords are encrypted), cookies for web mail or cloud storage, open tabs at shutdown.
It does not prove the user personally viewed the page: redirects, pop-ups, prefetching and synced history from another device all create entries. It also records nothing for private windows.

Key fields

Source (table)	Useful columns
Chromium `History` → `urls`	`url`, `title`, `visit_count`, `typed_count`, `last_visit_time`
Chromium `History` → `visits`	`visit_time`, `from_visit`, `transition` (link, typed, reload…), `visit_duration`
Chromium `History` → `downloads` (+ `downloads_url_chains`)	`target_path`, `start_time`, `end_time`, `received_bytes`, `total_bytes`, `state`, `danger_type`, `opened`, `referrer`, `tab_url`
Chromium `Network\Cookies` → `cookies`	`host_key`, `name`, `creation_utc`, `last_access_utc`, `expires_utc`, `encrypted_value`
Chromium `Login Data` → `logins`	`origin_url`, `username_value`, `date_created`, `date_last_used`
Chromium `Web Data` → `autofill`	Form field names and values typed by the user
Firefox `places.sqlite` → `moz_places`	`url`, `title`, `visit_count`, `typed`, `last_visit_date`
Firefox `places.sqlite` → `moz_historyvisits`	`visit_date`, `visit_type`, `from_visit`
Firefox `places.sqlite` → `moz_annos`	Download annotations (`downloads/destinationFileURI`, `downloads/metaData`)
Firefox `formhistory.sqlite` → `moz_formhistory`	`fieldname`, `value`, `timesUsed`, `firstUsed`, `lastUsed`

Timestamps

Timestamp	Set when	Format	Pitfalls
Chromium `visit_time`, `last_visit_time`, download `start_time`	Page load / download start	WebKit time: microseconds since 1601-01-01, UTC	Multiply by 10 to get a FILETIME; a synced visit from another device looks the same as a local one
Chromium cookie `creation_utc`, `last_access_utc`	Cookie set / sent	WebKit time, UTC	Cookie values themselves are encrypted
Firefox `visit_date`, `last_visit_date`, `dateAdded`	Visit / download	PRTime: microseconds since 1970-01-01, UTC	Not seconds: divide by 1,000,000
Firefox `formhistory` `firstUsed`, `lastUsed`	Form entry saved / reused	PRTime, UTC	Only shows first and last use
`WebCacheV01.dat` container times	Access, modification, expiry	FILETIME, UTC	Needs an ESE-aware tool; the database is usually dirty when copied live

All of these are stored in UTC; convert once, and check the time zone your tool applies.

Retention and clearing

Chrome and Edge expire history older than about 90 days; Firefox expires old visits according to a size-based policy for places.sqlite rather than a fixed age.
"Clear browsing data" deletes rows, but pages often survive in SQLite free pages, the WAL or journal, the cache and volume shadow copies: carve them with SQLite-aware tools (file carving).
Private/Incognito windows write no history to the profile. Traces can remain in memory, the pagefile, DNS cache, SRUM network byte counts and downloaded files themselves (with Zone.Identifier).
Chrome 127 added app-bound encryption for cookies on Windows; together with DPAPI this makes cookie and password decryption offline much harder. Structural metadata (host, timestamps) stays readable.

Collection

KAPE target: WebBrowsers (compound: Chrome, EdgeChromium, Firefox, InternetExplorer and other browsers), plus BrowserCache for cache folders
Velociraptor (Windows.Triage.Targets): WebBrowsers, BrowserCache (or single browsers: Chrome, EdgeChromium, Firefox, InternetExplorer)
Built-in: close the browser or copy through a shadow copy, because open databases are locked and recent changes sit in the WAL.

robocopy "C:\Users\alice\AppData\Local\Google\Chrome\User Data\Default" E:\case\chrome History* Login* "Web Data*" Shortcuts* "Top Sites*" /COPY:DAT
robocopy "C:\Users\alice\AppData\Local\Google\Chrome\User Data\Default\Network" E:\case\chrome\Network Cookies* /COPY:DAT
robocopy C:\Users\alice\AppData\Roaming\Mozilla\Firefox\Profiles E:\case\firefox places.sqlite* cookies.sqlite* formhistory.sqlite* /S /COPY:DAT
esentutl.exe /y C:\Users\alice\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat /vss /d E:\case\WebCacheV01.dat

Parsing tools

Hindsight (Ryan Benson, open source): full Chromium profile parser (history, downloads, cookies, autofill, preferences, cache, LevelDB) with timeline output.
DB Browser for SQLite: open any history database directly; apply the WAL first by opening a working copy with the -wal beside it.
BrowsingHistoryView (NirSoft, free): combined history from Chrome, Edge, Firefox and IE; ChromeCacheView and MozillaCacheView for caches.
SQLECmd (Eric Zimmerman): maps for Chromium history, downloads, cookies, autofill, shortcuts and Firefox history, downloads, cookies, form history.
Velociraptor: Windows.Applications.Chrome.History, Windows.Applications.Edge.History, Windows.Applications.Firefox.History (being replaced by the Generic.Forensic.SQLiteHunter extra).
Plaso: Chrome, Firefox and MSIE WebCache parsers feed browser events into a super timeline.

Investigation tips

Match each download row to the file on disk and its Zone.Identifier stream (HostUrl, ReferrerUrl) to prove the file came from that URL (Mark of the Web).
Follow the Chromium from_visit chain and transition type to tell a typed URL from a click or redirect, and to rebuild how the user reached a phishing page.
Look for cloud-storage and file-sharing uploads (drive, file transfer, paste sites) and correlate the window with SRUM bytes sent by the browser process.
Check every profile folder, not just Default, and every installed browser: Edge and Chrome often coexist.
Cross-check with LNK files and Jump Lists to show a downloaded document was later opened.
If history is empty but cookies, cache or Top Sites are full, suspect selective clearing and look at the WAL, free pages and shadow copies.

Browser artifacts (Chrome, Edge, Firefox)

Tools