Chrome bookmarks forensics

Bookmarks survive history clearing. A user who wipes their browsing history rarely thinks to prune their bookmarks, so the Bookmarks file often outlives the History database as evidence of sustained interest. It is plain JSON, it carries creation timestamps, and it keeps a backup copy of its own previous state.

The file

Chrome stores bookmarks in a file literally named Bookmarks — no extension — inside the profile directory:

…\User Data\<profile>\Bookmarks
…\User Data\<profile>\Bookmarks.bak

Bookmarks.bak is the previous version of the file, written before Chrome overwrites Bookmarks. It is the single most useful artifact here: diff it against the live file to recover bookmarks that were recently removed or renamed, or to reconstruct the state before the last change. Both are JSON, so any text editor opens them — no SQLite tooling needed. See where browsers store their artifacts for the rest of the profile layout.

The JSON tree

The top level is a roots object containing three trees:

bookmark_bar — the visible toolbar. High signal: these are the destinations a user wanted one click away.
other — the "Other bookmarks" catch-all.
synced — items pulled in via the user's Google account (formerly "mobile bookmarks").

Every entry is a node with a type of either url or folder:

{
  "type": "url",
  "name": "Admin console",
  "url": "https://internal.corp.example/admin",
  "date_added": "13354723200000000",
  "guid": "a1b2c3d4-...",
  "date_modified": "0"
}

Folders carry a children array instead of a url, and the nesting can go arbitrarily deep. Each node also has a guid (stable across syncs, useful for correlating the same bookmark across profiles or devices).

Timestamps

date_added and date_modified are the WebKit/Chrome epoch: microseconds since 1601-01-01 00:00:00 UTC. Convert exactly as you would a History timestamp:

unix_ms = chromium_value / 1000 - 11644473600000

date_added tells you when the user saved the bookmark, which is frequently a tighter and more meaningful timestamp than first-visit data — it marks the moment the user decided a page was worth keeping. date_modified is usually 0 on individual URLs and only populated on folders when their contents change. Sanity-check one known value before bulk converting; an epoch slip here lands everything in the 1600s. See browser timestamp formats for the full breakdown.

What bookmarks reveal

Sustained interest. Anyone can land on a page once. A bookmark is a deliberate act of saving — it says the user expected to return.
Accounts and services. Bookmarked login pages, dashboards, and webmail map out the accounts a user actually used.
Internal and admin URLs. Bookmarks to internal hostnames, admin consoles, and intranet paths reveal access to systems that may never appear in public DNS or external logs.
Timeline anchors. date_added gives a precise "the user knew about this by" timestamp, useful for placing knowledge or intent on a timeline.
Deleted activity. A removed bookmark still living in Bookmarks.bak can show interest the user later tried to erase.

Cross-reference bookmarked URLs against the history database: a bookmark with no surviving visits is a strong indicator that history was cleared while the bookmark was left behind.

Working with the tool

BrowserForensics flattens the bookmark tree into a flat table of folder / name / url / date_added, so you read the whole profile as a timeline instead of clicking through nested folders. Load both Bookmarks and Bookmarks.bak to spot what changed between the last two saves. Everything runs in your browser — the JSON never leaves the machine.