extracting-browser-history-artifacts

# Extracting Browser History Artifacts ## When to Use - When investigating user web activity as part of a forensic examination - During insider threat investigations to establish patterns of data exfiltration - When tracing user visits to malicious or policy-violating websites - For correlating browser activity with other forensic artifacts and timelines - When investigating phishing attacks to identify which links were clicked ## Prerequisites - Forensic image or access to user profile directories - SQLite3 for querying browser databases - Hindsight, BrowsingHistoryView, or DB Browser for SQLite - Knowledge of browser artifact file locations per OS - Python 3 with sqlite3 module for automated extraction - Understanding of Chrome, Firefox, and Edge storage formats ## Workflow ### Step 1: Locate Browser Artifact Files ```bash # Mount forensic image mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence # Chrome artifact locations (Windows) CHROME_WIN="/mnt/evidence/Users/suspect/AppData/Local/Google/Chrome/User Data/Default" # Key files: History, Cookies, Login Data, Web Data, Bookmarks, Preferences, # Cache/, GPUCache/, Local Storage/, Session Storage/, IndexedDB/ # Firefox artifact locations (Windows) FIREFOX_WIN="/mnt/evidence/Users/suspect/AppData/Roaming/Mozilla/Firefox/Profiles/*.default-release" # Key files: places.sqlite, cookies.sqlite, formhistory.sqlite, logins.json, # key4.db, sessionstore.jsonlz4, w...