<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-browser-artifacts
description: >-
  Browser forensic analysis of Chrome, Firefox, Edge, and Safari artifacts
  including history, cookies, cache, bookmarks, autofill, saved passwords,
  session data, and IndexedDB using SQLite parsing, Hindsight, and KAPE
  for incident response and digital investigations.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - browser-forensics
  - chrome
  - firefox
  - edge
  - safari
  - sqlite
  - hindsight
  - kape
  - cookies
  - web-history
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1217", "T1539", "T1005"]
  nist-csf: ["RS.AN-1", "RS.AN-3"]
  frameworks: ["NIST SP 800-86", "SANS FOR498"]
---

# Analyzing Browser Artifacts

## Overview

Web browsers store extensive forensic artifacts that reveal user activity,
authentication sessions, downloaded files, and communication patterns.
This skill covers extraction and analysis of browser databases across
Chrome, Firefox, Edge, and Safari using SQLite queries, Hindsight, and
automated parsing tools.

## Prerequisites

- Forensic workstation with Python 3.10+
- `sqlite3`, `Hindsight`, `browserexport`, `KAPE`
- Copy of browser profile directories (not live — use forensic image)
- `strings`, `xxd` for cache carving

```bash
pip install pyhindsight browserexport
sudo apt install sqlite3
```

## Key Concepts

### Browser Profile Paths

| Browser | Windows | Linux | macOS |
|---------|---------|-------|-------|
| Chrome | `%LOCALAPPDATA%\Google\Chrome\User Data\Default\` | `~/.config/google-chrome/Default/` | `~/Library/Application Support/Google/Chrome/Default/` |
| Firefox | `%APPDATA%\Mozilla\Firefox\Profiles\*.default-release\` | `~/.mozilla/firefox/*.default-release/` | `~/Library/Application Support/Firefox/Profiles/` |
| Edge | `%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\` | `~/.config/microsoft-edge/Default/` | `~/Library/Application Support/Microsoft Edge/Default/` |
| Safari | N/A | N/A | `~/Library/Safari/` |

### Key Artifact Files

| Artifact | Chrome/Edge File | Firefox File | Data |
|----------|------------------|--------------|------|
| History | `History` | `places.sqlite` | URLs, visits, timestamps |
| Cookies | `Cookies` | `cookies.sqlite` | Session tokens, tracking |
| Login Data | `Login Data` | `logins.json` | Saved credentials |
| Bookmarks | `Bookmarks` | `places.sqlite` | Bookmarked URLs |
| Downloads | `History` | `places.sqlite` | Downloaded files |
| Autofill | `Web Data` | `formhistory.sqlite` | Form field entries |
| Cache | `Cache/` | `cache2/` | Cached web content |

## Workflow

### Step 1: Extract Browser History

```bash
# Chrome / Edge — History database (SQLite)
sqlite3 "History" "SELECT
  datetime(last_visit_time/1000000-11644473600,'unixepoch') as visit_time,
  url, title, visit_count
FROM urls ORDER BY last_visit_time DESC LIMIT 100;"

# Firefox — places.sqlite
sqlite3 "places.sqlite" "SELECT
  datetime(moz_historyvisits.visit_date/1000000,'unixepoch') as visit_time,
  moz_places.url, moz_places.title
FROM moz_places
JOIN moz_historyvisits ON moz_places.id = moz_historyvisits.place_id
ORDER BY visit_date DESC LIMIT 100;"

# Safari — History.db
sqlite3 "History.db" "SELECT
  datetime(visit_time + 978307200, 'unixepoch') as visit_time,
  history_item, title
FROM history_visits
JOIN history_items ON history_visits.history_item = history_items.id
ORDER BY visit_time DESC LIMIT 100;"
```

### Step 2: Extract Cookies and Session Tokens

```bash
# Chrome cookies — encrypted on modern versions
sqlite3 "Cookies" "SELECT
  datetime(creation_utc/1000000-11644473600,'unixepoch') as created,
  host_key, name, path,
  datetime(expires_utc/1000000-11644473600,'unixepoch') as expires,
  is_secure, is_httponly
FROM cookies WHERE host_key LIKE '%target-domain%';"

# Firefox cookies
sqlite3 "cookies.sqlite" "SELECT
  datetime(creationTime/1000000,'unixepoch') as created,
  host, name, path, value,
  datetime(expiry,'unixepoch') as expires
FROM moz_cookies WHERE host LIKE '%target-domain%';"
```

### Step 3: Extract Downloads and Autofill

```bash
# Chrome downloads
sqlite3 "History" "SELECT
  datetime(start_time/1000000-11644473600,'unixepoch') as started,
  target_path, tab_url, total_bytes, state
FROM downloads ORDER BY start_time DESC;"

# Chrome autofill
sqlite3 "Web Data" "SELECT
  name, value, count,
  datetime(date_created,'unixepoch') as created,
  datetime(date_last_used,'unixepoch') as last_used
FROM autofill ORDER BY date_last_used DESC;"

# Firefox form history
sqlite3 "formhistory.sqlite" "SELECT
  fieldname, value, timesUsed,
  datetime(firstUsed/1000000,'unixepoch') as first_used,
  datetime(lastUsed/1000000,'unixepoch') as last_used
FROM moz_formhistory ORDER BY lastUsed DESC;"
```

### Step 4: Hindsight — Automated Chrome Analysis

```bash
# Run Hindsight against Chrome profile
hindsight -i "/path/to/Chrome/User Data/Default" \
  -o chrome_analysis \
  -f xlsx

# Output formats: xlsx, sqlite, jsonl
hindsight -i "/path/to/Chrome/User Data/Default" \
  -o chrome_analysis \
  -f sqlite
```

### Step 5: Cache Analysis

```bash
# Chrome Cache — parse with chrome-cache tool
python -m cacheParse "Cache/Cache_Data/" -o cache_report/

# Firefox cache2 entries
ls -la cache2/entries/ | wc -l
file cache2/entries/* | head -20

# Carve images from cache
find Cache/ -type f -exec file {} \; | grep -i "jpeg\|png\|gif" > cached_images.txt

# Strings extraction for URLs in cache
strings Cache/Cache_Data/data_1 | grep -E "^https?://" | sort -u > cached_urls.txt
```

## Detection

```yaml
title: Browser Artifacts Detection
id: 72d1d219-e83d-45b1-8d57-219e653d2032
status: experimental
description: Detects suspicious activity related to analyzing browser artifacts techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*browser*"
  condition: selection
level: medium
tags:
  - attack.t1217
  - attack.t1539
  - attack.t1005
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Browser profile copied forensically (not from live system)
- [ ] All relevant SQLite databases queried
- [ ] Timestamp normalization applied (WebKit, PRTime, Unix epoch)
- [ ] Cookie encryption handled for Chrome/Edge
- [ ] Download history correlated with file system artifacts
- [ ] Cache carved for relevant content
- [ ] Results exported in structured format

## References

- [Hindsight — Chrome/Chromium Forensics](https://github.com/obsidianforensics/hindsight)
- [SANS FOR498 — Browser Forensics](https://www.sans.org/cyber-security-courses/battlefield-forensics-data-acquisition/)
- [Chrome Forensics — ForensicsWiki](https://forensics.wiki/google_chrome/)
- [Firefox Forensics — places.sqlite Schema](https://forensics.wiki/mozilla_firefox/)
- [browserexport — Cross-browser History Export](https://github.com/seanbreckenridge/browserexport)
