Choosing a browser forensics tool

There is no single "best" browser-forensics tool, and any list that claims otherwise is selling something. What matters is whether a tool covers the browsers and artifacts in front of you, decrypts what you need, and handles your evidence the way your case requires. The criteria below are the ones I actually weigh before reaching for a tool.

Artifact coverage

The first question is breadth. Which browser families does it parse — Chrome/Edge/Chromium, Firefox, Safari — and which artifact classes within each? Look for history and downloads, cookies, saved passwords and payment cards, cache, extensions, Local Storage / IndexedDB, and session/tab state. A tool that only reads History will miss most of the cross-artifact corroboration that makes browser evidence worth presenting. Coverage gaps are where cases quietly fall apart, so check the artifact list against what you expect to find, not against the marketing headline.

Decryption

Reading cookie metadata is easy; reading the value is not. On Chromium since v80 the secret fields are encrypted at rest, and the scheme keeps moving — DPAPI-wrapped keys on Windows, the Safe Storage keyring on macOS and Linux, and the v20 app-bound encryption now used for cookies. Firefox wraps logins with NSS. Ask explicitly: can the tool decrypt cookies, passwords and cards, and which key-protection schemes does it support? A parser that stops at the ciphertext leaves you with timestamps but no content.

Format support

Browser artifacts are not all SQLite. A capable tool reads SQLite with its -wal/-shm sidecars, LevelDB (Local Storage, IndexedDB, the session store), binary plist and Cookies.binarycookies for Safari, and ESE for older Edge/IE remnants. Partial format support tends to show up as silent omissions rather than errors, so it is worth confirming up front.

Analysis

Parsing is step one; making sense of the output is the work. The features that earn their place are a unified timeline that normalises each browser's epoch into one chronological view, search and IOC matching across artifacts, and an overview that surfaces what is present before you start drilling. A tool that dumps tables but never correlates them just moves the join into your spreadsheet. See analysing a profile end to end for what that workflow looks like in practice.

Reporting and integrity

If findings leave your machine, they need to leave cleanly. Look for export to CSV and JSON, a readable report, and integrity features — file hashing and enough provenance to support a chain of custody. These matter most in incident response and any matter that may end up in front of a reviewer, where "trust me" is not an acceptable export format.

Privacy: does evidence leave your machine?

This is the criterion people skip and later regret. Some tools upload the profile — or parts of it — to a cloud backend for processing. For sensitive, regulated, or legally privileged material, that single design choice can rule a tool out regardless of how good its parser is. Confirm whether evidence stays local or is transmitted, and whether the tool can run offline at all. For air-gapped or classified work, anything that phones home is a non-starter.

The categories of tooling

In practice tools fall into three buckets, each with trade-offs:

Commercial suites. Broad coverage, polished reporting, support contracts — at a price, and often as part of a larger disk/memory product.
Open-source CLI parsers. Scriptable, transparent, free, and excellent in a pipeline; they assume you bring your own correlation and reporting.
Client-side / in-browser tools. No install, fast to reach for, and (when done right) keep evidence local; scope is usually triage rather than full-disk forensics.

None of these is universally best. The right pick depends on the case, the environment, and what the rest of your toolchain already does.

Where BrowserForensics fits

To be clear about our own position: BrowserForensics is a free, 100% client-side parser and decryptor. The profile you load is processed in the browser tab — nothing is uploaded — which makes it well suited to fast triage and to air-gapped work where evidence cannot leave the machine. It decrypts cookies, passwords and cards across Chromium, Firefox and Safari, builds a unified timeline, and exports to CSV/JSON.

It is not a replacement for full disk- and memory-forensics suites, and it does not try to be. Think of it as a way to answer the browser-side questions quickly, then hand off to heavier tooling when the case needs it. If most of your work is browser triage, that may be all you need; if not, it slots in alongside whatever already does your disk and memory work.