<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-browser-forensics
description: >-
  Browser artifact extraction and analysis including Chrome, Firefox, Edge,
  and Safari history, cookies, cache, downloads, bookmarks, autofill,
  saved passwords, session storage, IndexedDB, and private browsing
  artifact recovery using Hindsight, DB Browser, and manual SQLite queries.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - browser-forensics
  - chrome
  - firefox
  - edge
  - safari
  - hindsight
  - sqlite
  - browsing-history
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1217", "T1555.003", "T1539"]
  nist-csf: ["RS.AN-3"]
  frameworks: ["NIST SP 800-86"]
---

# Performing Browser Forensics

## Overview

Web browsers store extensive forensic artifacts including browsing history,
cookies, cached content, downloads, form data, saved credentials, and
session information. This skill covers artifact location for major browsers,
SQLite database querying, Chrome timestamp conversion, Hindsight automated
analysis, and private/incognito artifact recovery.

## Prerequisites

- Python 3.10+ with `sqlite3` (stdlib), `pyhindsight`
- Hindsight browser forensic tool
- DB Browser for SQLite (optional GUI)
- Access to browser profile directories (from forensic image or live system)

```bash
pip install pyhindsight
```

## Key Concepts

### Browser Profile Locations

**Google Chrome:**
```
Windows: C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\
macOS:   ~/Library/Application Support/Google/Chrome/Default/
Linux:   ~/.config/google-chrome/Default/
```

**Mozilla Firefox:**
```
Windows: C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<random>.default\
macOS:   ~/Library/Application Support/Firefox/Profiles/<random>.default/
Linux:   ~/.mozilla/firefox/<random>.default/
```

**Microsoft Edge:**
```
Windows: C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\Default\
```

**Safari:**
```
macOS:   ~/Library/Safari/
iOS:     via iTunes backup at ~/Library/Application Support/MobileSync/Backup/
```

### Chrome Database Files

| File | Contents |
|------|----------|
| `History` | URLs, visits, downloads, keyword searches |
| `Cookies` | Cookie names, values, domains, expiration |
| `Login Data` | Saved usernames and encrypted passwords |
| `Web Data` | Autofill entries, credit cards |
| `Bookmarks` | Bookmark tree (JSON) |
| `Preferences` | User settings (JSON) |
| `Top Sites` | Frequently visited sites |
| `Favicons` | Site icon cache |
| `Network Action Predictor` | Typed URL predictions |

### Chrome Timestamps

Chrome uses WebKit/Chrome epoch: microseconds since 1601-01-01 00:00:00 UTC.

```python
from datetime import datetime, timedelta, timezone

def chrome_time(timestamp: int) -> str:
    epoch = datetime(1601, 1, 1, tzinfo=timezone.utc)
    return (epoch + timedelta(microseconds=timestamp)).isoformat()
```

## Workflow

### Step 1: Extract History with SQL

```sql
-- Chrome/Edge browsing history
SELECT
    urls.url,
    urls.title,
    datetime(visits.visit_time / 1000000 - 11644473600, 'unixepoch') AS visit_date,
    visits.transition,
    visits.visit_duration / 1000000.0 AS duration_seconds
FROM visits
JOIN urls ON visits.url = urls.id
ORDER BY visits.visit_time DESC
LIMIT 500;

-- Chrome downloads
SELECT
    target_path,
    tab_url AS source_url,
    total_bytes,
    datetime(start_time / 1000000 - 11644473600, 'unixepoch') AS download_date,
    state,
    danger_type
FROM downloads
ORDER BY start_time DESC;
```

### Step 2: Extract Cookies

```sql
-- Chrome cookies (Cookies database)
SELECT
    host_key,
    name,
    path,
    datetime(creation_utc / 1000000 - 11644473600, 'unixepoch') AS created,
    datetime(expires_utc / 1000000 - 11644473600, 'unixepoch') AS expires,
    is_secure,
    is_httponly,
    samesite
FROM cookies
WHERE host_key LIKE '%example.com%'
ORDER BY creation_utc DESC;
```

### Step 3: Firefox Artifacts

```sql
-- Firefox history (places.sqlite)
SELECT
    moz_places.url,
    moz_places.title,
    datetime(moz_historyvisits.visit_date / 1000000, 'unixepoch') AS visit_date,
    moz_places.visit_count
FROM moz_historyvisits
JOIN moz_places ON moz_historyvisits.place_id = moz_places.id
ORDER BY moz_historyvisits.visit_date DESC
LIMIT 500;

-- Firefox downloads (places.sqlite)
SELECT
    moz_annos.content AS download_path,
    moz_places.url AS source_url,
    datetime(moz_annos.dateAdded / 1000000, 'unixepoch') AS download_date
FROM moz_annos
JOIN moz_places ON moz_annos.place_id = moz_places.id
WHERE moz_annos.anno_attribute_id = 1;
```

### Step 4: Automated Analysis with Hindsight

```bash
# Analyze Chrome profile
hindsight -i "/path/to/Chrome/User Data/Default" -o chrome_report

# Output formats: XLSX, SQLite, JSON
hindsight -i "/path/to/Chrome/User Data/Default" -o report -f xlsx
```

### Step 5: Recover Deleted Browser Data

```bash
# Carve SQLite records from unallocated space
# SQLite deleted records may still exist in database pages
sqlite3 History "SELECT * FROM urls" > current.txt

# Use undark for SQLite recovery
undark -i History > recovered_records.csv

# photorec for carved browser databases from disk image
photorec /d recovered/ evidence.dd
find recovered/ -name "*.sqlite" -o -name "History" -o -name "places.sqlite"
```

## Detection

```yaml
title: Browser Forensics Detection
id: 3e8403f9-1b68-498b-9670-1e89027e71ab
status: experimental
description: Detects suspicious activity related to performing browser forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*browser*"
  condition: selection
level: medium
tags:
  - attack.t1217
  - attack.t1555.003
  - attack.t1539
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Browser profile directories identified and preserved
- [ ] History database queried with proper timestamp conversion
- [ ] Cookies extracted with domain and security flag analysis
- [ ] Downloads correlated with source URLs
- [ ] Autofill and saved credential databases examined
- [ ] Deleted records recovery attempted
- [ ] Timeline of browsing activity reconstructed

## References

- [Hindsight — Chrome/Chromium Forensics](https://github.com/obsidianforensics/hindsight)
- [Chrome Forensics — SANS](https://www.sans.org/blog/google-chrome-forensics/)
- [Firefox Forensics — places.sqlite](https://wiki.mozilla.org/Places)
- [MITRE T1217 — Browser Information Discovery](https://attack.mitre.org/techniques/T1217/)
