browserforensics
Back to all articles

Microsoft Edge history file locations

2026-05-19 · 1 min

Microsoft Edge is built on Chromium, so its on-disk layout mirrors Chrome exactly — only the vendor folder differs. The forensic artifacts live in the Default profile (or Profile 1, Profile 2, …).

Profile folder by operating system

Windows

C:\Users\<username>\AppData\Local\Microsoft\Edge\User Data\Default

macOS

/Users/<username>/Library/Application Support/Microsoft Edge/Default

Linux

/home/<username>/.config/microsoft-edge/Default

What each file holds

Identical to Chrome:

DataFileFormat
Website visits / searches / downloadsHistorySQLite
CookiesCookies (in Network/)SQLite
Form historyWeb DataSQLite
LoginsLogin DataSQLite
FaviconsFaviconsSQLite
Top sitesTop SitesSQLite
BookmarksBookmarksJSON
Local/Session Storage, IndexedDBLevelDB foldersLevelDB

Because the schemas are identical, this parser auto-detects Edge files by their table structure — just drop the Default folder in. Edge timestamps use the same epoch as Chrome (microseconds since 1601‑01‑01 UTC).