<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Browser Forensics

## Hindsight (Chrome/Chromium Forensics)

```bash
# Analyze Chrome profile
hindsight -i "/path/to/Chrome/User Data/Default" -o report

# Specify output format
hindsight -i "/path/to/Chrome/User Data/Default" -o report -f xlsx
hindsight -i "/path/to/Chrome/User Data/Default" -o report -f sqlite
hindsight -i "/path/to/Chrome/User Data/Default" -o report -f json

# Specify browser type
hindsight -i "/path/to/profile" -b brave -o report
```

| Flag | Description |
|------|-------------|
| `-i` | Input profile path |
| `-o` | Output file base name |
| `-f` | Format: xlsx, sqlite, json (default: xlsx) |
| `-b` | Browser type: chrome, brave, edge |
| `-t` | Timezone for display |

## SQLite3 CLI — Chrome Queries

```bash
# Open Chrome History database
sqlite3 "/path/to/Chrome/Default/History"

# List tables
.tables

# Schema for urls table
.schema urls

# Browsing history with timestamps
SELECT url, title,
       datetime(last_visit_time/1000000-11644473600, 'unixepoch') AS visit_date
FROM urls ORDER BY last_visit_time DESC LIMIT 50;
```

## Chrome Timestamp Conversion

```
Chrome epoch: microseconds since 1601-01-01 00:00:00 UTC
Unix conversion: (chrome_timestamp / 1000000) - 11644473600

SQL (in SQLite):
  datetime(timestamp / 1000000 - 11644473600, 'unixepoch')

Python:
  datetime(1601, 1, 1) + timedelta(microseconds=timestamp)
```

## Firefox Database Schema

### places.sqlite

```sql
-- Key tables
moz_places        -- URLs and visit counts
moz_historyvisits -- Individual visits with timestamps
moz_bookmarks     -- Bookmarks
moz_annos         -- Annotations (downloads, etc.)
moz_inputhistory  -- Form autocomplete data

-- Firefox timestamp: microseconds since Unix epoch
-- SQL conversion:
datetime(visit_date / 1000000, 'unixepoch')
```

### cookies.sqlite

```sql
SELECT host, name, value, path,
       datetime(creationTime / 1000000, 'unixepoch') AS created,
       datetime(expiry, 'unixepoch') AS expires,
       isSecure, isHttpOnly
FROM moz_cookies
ORDER BY creationTime DESC;
```

## Safari Databases

```
History.db     -- Browsing history (history_items, history_visits)
Bookmarks.plist -- Bookmarks
TopSites.plist  -- Frequently visited
Downloads.plist -- Download history

-- Safari timestamp: seconds since 2001-01-01 (Core Data epoch)
-- SQL: datetime(visit_time + 978307200, 'unixepoch')
```

## undark — SQLite Deleted Record Recovery

```bash
# Recover deleted records from SQLite database
undark -i History > recovered.csv

# Include freelist pages
undark -i History --freelist > recovered_freelist.csv
```

## Browser Artifact Locations Summary

| Browser | History DB | Cookies DB | Login DB |
|---------|-----------|------------|----------|
| Chrome | `History` | `Cookies` | `Login Data` |
| Firefox | `places.sqlite` | `cookies.sqlite` | `logins.json` + `key4.db` |
| Edge | `History` | `Cookies` | `Login Data` |
| Safari | `History.db` | `Cookies.binarycookies` | Keychain |
