Browser Forensics

What it is and why it matters

A browser is a diary that writes itself. Each page visit goes into a history database. Each search goes into a table of search terms. Each download is recorded with its source URL, its path on disk and whether it finished. Cookies record logins, cached files keep copies of what was seen and session files remember every open tab so the browser can restore them after a crash. Nobody asks for this record, but almost everyone has one.

The four browsers that matter most share a great deal. Chrome and Edge are both built on Chromium and keep their data in the same set of SQLite databases, JSON files and LevelDB stores inside a profile folder. Firefox uses its own profile layout with places.sqlite at the centre. Safari on a Mac uses a mix of SQLite and property list files. Knowing which file holds what, which timestamp format each uses and what a journal or write-ahead log beside the database may still contain is the core skill.

Browser evidence is rarely the whole case, but it is often the thread that ties the rest together. It shows the search that preceded a purchase, the webmail that carried a file out, the cloud site where a document was uploaded and the time the user was at the keyboard. Read carefully, with its limits stated, it is among the most persuasive records on a computer.

Types of digital evidence

Browsing History
URLs, page titles, visit times, visit counts and how each visit was reached, held in Chromium's History database and Firefox's places.sqlite.
Search Terms
Words typed into a search engine's box, kept separately in Chromium's keyword_search_terms table and recoverable from URLs in any browser.
Downloads
The source URL, the referrer, the saved path, size, start and end times and the completion state of every download, stored in the History database on Chromium and in places.sqlite annotations on Firefox.
Cookies
Site, name, creation, last access and expiry times for each cookie, with values that recent browsers encrypt using the operating system's key store.
Cache
Copies of pages, images, scripts and sometimes documents fetched from sites, with the URL and response headers, in Chromium's Cache folder and Firefox's cache2 folder.
Session and Tab Data
The open tabs and windows and their back-forward history at the last save, in Chromium's Sessions folder and Firefox's sessionstore-backups folder, which can show what was open at a moment even after the history was cleared.
Saved Credentials and Form Data
The sites for which a password was saved, in Chromium's Login Data and Firefox's logins.json, and autofill entries such as names, addresses and search box contents.
Bookmarks, Preferences and Extensions
The bookmarks file, the profile preferences and the installed extensions, which show how the browser was set up and which accounts it was synced to.

Devices and data sources

Chrome and Edge profile folders under the user's local application data on Windows, in the Library folder on macOS and in the home directory on Linux
Firefox profile folders, each with its own places.sqlite, cookies.sqlite, formhistory.sqlite and sessionstore-backups
Safari data in the user's Library folder on macOS, including History.db and Downloads.plist
Mobile browser data from Android and iOS extractions, including Chrome and Safari on phones
Older Internet Explorer and legacy Edge data in the WebCacheV01.dat ESE database
Synced copies of history and tabs on other devices signed into the same browser account
Volume Shadow Copies and backups that preserve an earlier state of the profile
RAM, where page content, URLs and private browsing traces may remain after the browser closes

How an examination runs

The order matters. Each step protects the one after it.

01
Authority and Scope
Browsing history is personal data. Confirm the lawful basis and the questions to answer, and keep the examination to the period and the people in scope.
02
Locate Every Profile
Find all browsers and all profiles for every user account on the device, including portable browsers and profiles in unusual locations. Note the browser version, since file layouts change.
03
Copy the Profile With Its Sidecar Files
Take the whole profile folder from the forensic image, including journal, write-ahead log and shared memory files beside each database. Opening a database without its WAL file can hide the most recent records.
04
Parse With a Tool and Verify by Hand
Let the forensic suite decode history, downloads, cookies and sessions, then open the key databases directly and confirm the records and their timestamps.
05
Convert Timestamps Correctly
Chromium stores microseconds since 1 January 1601, Firefox stores microseconds since 1 January 1970 and Safari stores seconds since 1 January 2001. Convert each with the right epoch and state the time zone used.
06
Correlate and Report
Join browser records with file system timestamps, cloud sync logs and network logs, and report visits, searches and downloads with their source file, table and record so another examiner can check them.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Profile: The folder holding one user's data for one browser. A browser can have several profiles, each with its own history and cookies.
SQLite: The file-based database format used by all major browsers for history and cookies. It is read directly with any SQLite tool as well as by forensic suites.
Write-Ahead Log: The -wal file beside a SQLite database in WAL mode, holding committed changes not yet written into the main file. It can contain the newest visits and records that were deleted from the main database.
WebKit Time: Chromium's timestamp format, a count of microseconds since 1 January 1601 UTC, used in the History, Cookies and Login Data databases.
PRTime: Firefox's timestamp format, microseconds since 1 January 1970 UTC, used throughout places.sqlite.
Transition Type: The field in Chromium's visits table that records how a page was reached, for example typed, link, reload or form submission, which tells the examiner whether the user went there deliberately.
LevelDB: The key-value store Chromium uses for Local Storage, Session Storage and IndexedDB data belonging to web applications.
Session Restore: The browser's record of open tabs and windows, written regularly so the session can be rebuilt. It is a separate store from history and survives history clearing.
Private Browsing: A mode in which the browser does not save history, cookies or cache to the profile. Traces can still exist in memory, in DNS caches and in the operating system.

Challenges and limits

What makes it hard

Private and incognito modes keep most records out of the profile, so disk evidence of those sessions is thin and the examiner must say so rather than infer
History clearing, anti-forensic tools and short retention settings remove records, though session files, cache, WAL remnants and shadow copies often keep part of them
Cookie values and saved passwords are encrypted with keys tied to the user's operating system account, and are readable only in a lawful live examination or with the user's credentials under authority
Browser sync merges history from several devices into one profile, so a visit in the database may have happened on a different machine
Each browser release can change file names, schemas and timestamp handling, and a tool that has not caught up will misread or miss records
A URL in history shows that the browser fetched a page, not that a person read it. Redirects, prefetching and embedded frames generate visits nobody saw

Keeping the evidence intact

Work only from the forensic image or a hashed copy of the profile folder, never by opening the browser on the evidence machine
Keep the database and its journal, WAL and shared memory files together, and hash each one
Record the browser version, the tool version and the timestamp conversion applied to every reported time
Verify any record used in a conclusion by reading it directly in the source database, not only in the tool's summary

Standards and legal considerations

NIST SP 800-86
Treats browser data among the application and operating system data sources and describes the examination process used here.
Read the guide
ISO/IEC 27037:2012
The preservation principles that govern copying profile folders from an image and documenting the process.
Read the guide
SWGDE Best Practices
SWGDE's computer forensic practice documents set expectations for tool validation, which matters because browser parsers break with every release.
Read the guide
Digital Personal Data Protection Act, 2023
Browsing records are personal data. An examination of an employee's or a complainant's browser must rest on a lawful basis and stay within its scope.
Read the guide

In practice

The Upload Before Resignation
A company suspects a leaving manager uploaded a client list. The Chromium History database shows visits to a personal cloud storage site, the session file shows an upload page open in a tab and the cache holds a response confirming a file name and size that match the client list exported from the CRM the same afternoon.
A Cleared History
A suspect's browser history is empty from a certain date. The History database's WAL file still holds visit rows from that period, the sessionstore-backups folder in Firefox contains a tab list from the day in question and a Volume Shadow Copy from the previous week contains the whole profile. The examiner reports the records and the fact that history was cleared after them.
Was Anyone at the Keyboard
A person claims their computer was used by someone else that evening. The browser shows a login to their own webmail at 21:10, a search typed in their usual style at 21:14 and a visit to a site bookmarked under their profile at 21:20. The examiner reports the records as consistent with the account holder's use but cannot say who was physically present.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.IntermediateDCFA

AdvancedAdvanced & Specialised ForensicsOSINT / Open Source IntelligenceFind, verify and record public online information in a form a court can checkIntermediate

Careers that use it

Computer Forensic Analyst

Questions people ask

Does incognito or private mode leave any trace?

Little on disk inside the browser profile. Traces may survive in memory while the machine is running, in the operating system's DNS cache, in downloaded files that the user kept and in network logs outside the machine.

Can deleted history be recovered?

Sometimes. Write-ahead log files, session files, cache entries and shadow copies often keep records after the history is cleared. Recovery is partial and the report should distinguish what was found from what the user cleared.

Why do the times in the tool differ from the times in the database?

Each browser uses its own epoch and the tool converts them. Check the conversion and the time zone. A wrong epoch gives a date centuries out, a wrong time zone gives a few hours, and both have caused errors in reports.

Can saved passwords be read from an image?

They are encrypted with a key tied to the operating system user account. Reading them needs the user's credentials or a live session, and both need explicit lawful authority. DFRTI teaches the mechanism, not the bypass.