Microsoft Edge history file locations
2026-05-19 · 2 min
Modern Edge is Chromium under a Microsoft shell, so its on-disk layout mirrors Chrome. Only the vendor directory differs, plus a few Edge-specific files (Collections, the Mobile sync database). Everything you know about parsing Chrome works here.
Profile root by OS
Windows
C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\<profile>
macOS
/Users/<user>/Library/Application Support/Microsoft Edge/<profile>
Linux
/home/<user>/.config/microsoft-edge/<profile>
<profile> is Default, Profile 1, Profile 2, etc. Edge for Business
users may also see a Profile <GUID> directory for managed identities.
What each file holds
Identical to Chrome's schema, byte for byte:
| Data | File | Format |
|---|---|---|
| Visits / searches / downloads | History | SQLite |
| Cookies | Network/Cookies | SQLite |
| Form history | Web Data | SQLite |
| Logins | Login Data | SQLite |
| Favicons | Favicons | SQLite |
| Top sites | Top Sites | SQLite |
| Bookmarks | Bookmarks | JSON |
| Local / Session Storage, IndexedDB | LevelDB folders | LevelDB |
| Collections | Collections/collectionsSQLite | SQLite |
Collections is Edge-specific and worth a look. It stores the URLs and clipped pages a user actively saved — much higher intent signal than casual browsing.
Edge legacy (EdgeHTML) is a different artefact
Pre-2020 Edge on Windows 10 used EdgeHTML and stored history in
WebCacheV01.dat, an ESE database under
C:\Users\<user>\AppData\Local\Microsoft\Windows\WebCache\. If you are
investigating a host that was never updated past 2020, you are dealing
with that format, not the Chromium one. The ESE engine is the same one
behind SRUM.
Timestamps and WAL
Edge uses the Chromium WebKit epoch: microseconds since 1601-01-01 UTC.
The WAL caveat from Chrome applies — collect History-wal and History-shm
or accept that the last commits are gone.
Acquisition notes
- Domain-joined hosts often have multiple managed profiles. Enumerate the
User Datadirectory rather than assumingDefault. - Edge's
MSEdgeWebView2.exe(used by Teams, Outlook, etc.) has its own embedded profile under\Microsoft\EdgeWebView\User Data\. Worth a glance if you suspect activity inside a host application.