<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Browser Artifacts

## SQLite3 — Browser Database Queries

**All major browsers store artifacts in SQLite databases.**

```bash
# Open read-only
sqlite3 "file:History?mode=ro"

# Chrome timestamp conversion (WebKit epoch → Unix)
# Chrome timestamps: microseconds since 1601-01-01
# Conversion: divide by 1000000, subtract 11644473600
datetime(timestamp/1000000-11644473600,'unixepoch')

# Firefox timestamp conversion (PRTime → Unix)
# Firefox timestamps: microseconds since Unix epoch
datetime(timestamp/1000000,'unixepoch')

# Safari timestamp conversion (Core Data → Unix)
# Safari timestamps: seconds since 2001-01-01
datetime(timestamp + 978307200, 'unixepoch')
```

| Epoch | Base Date | Unit | Browsers |
|-------|-----------|------|----------|
| WebKit | 1601-01-01 | Microseconds | Chrome, Edge, Opera |
| PRTime | 1970-01-01 | Microseconds | Firefox |
| Core Data | 2001-01-01 | Seconds | Safari |

## Hindsight

**Automated Chrome/Chromium forensic analysis.**

```bash
# Basic analysis
hindsight -i "/path/to/profile" -o report -f xlsx

# SQLite output for further querying
hindsight -i "/path/to/profile" -o report -f sqlite

# JSONL for streaming analysis
hindsight -i "/path/to/profile" -o report -f jsonl
```

| Flag | Description |
|------|-------------|
| `-i` | Input Chrome profile path |
| `-o` | Output base filename |
| `-f` | Output format: `xlsx`, `sqlite`, `jsonl` |
| `-b` | Browser type override |
| `-t` | Timezone for timestamp display |

## browserexport

**Cross-browser history export and merging.**

```bash
# Export history from browser database
browserexport merge chrome ~/path/to/History --json > history.json

# Merge multiple browser histories
browserexport merge chrome ~/chrome/History firefox ~/firefox/places.sqlite \
  --json > merged.json
```

## Chrome Cache Parser

```bash
# Parse Chrome cache directory
python -m cacheParse "Cache/Cache_Data/" -o cache_report/

# List cached URLs
strings Cache/Cache_Data/data_1 | grep -E "^https?://" | sort -u
```

## KAPE — Browser Artifact Targets

```
# KAPE target for browser collection
.\kape.exe --tsource C: --tdest .\output --target WebBrowsers

# Specific browser targets
--target ChromeHistory,ChromeCookies,ChromeCache
--target FirefoxHistory,FirefoxCookies,FirefoxCache
--target EdgeHistory,EdgeCookies
```
