browserforensics
Back to all articles

Microsoft Edge history file locations

2026-05-19 · 2 min

Modern Edge is Chromium under a Microsoft shell, so its on-disk layout mirrors Chrome. Only the vendor directory differs, plus a few Edge-specific files (Collections, the Mobile sync database). Everything you know about parsing Chrome works here.

Profile root by OS

Windows

C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\<profile>

macOS

/Users/<user>/Library/Application Support/Microsoft Edge/<profile>

Linux

/home/<user>/.config/microsoft-edge/<profile>

<profile> is Default, Profile 1, Profile 2, etc. Edge for Business users may also see a Profile <GUID> directory for managed identities.

What each file holds

Identical to Chrome's schema, byte for byte:

DataFileFormat
Visits / searches / downloadsHistorySQLite
CookiesNetwork/CookiesSQLite
Form historyWeb DataSQLite
LoginsLogin DataSQLite
FaviconsFaviconsSQLite
Top sitesTop SitesSQLite
BookmarksBookmarksJSON
Local / Session Storage, IndexedDBLevelDB foldersLevelDB
CollectionsCollections/collectionsSQLiteSQLite

Collections is Edge-specific and worth a look. It stores the URLs and clipped pages a user actively saved — much higher intent signal than casual browsing.

Edge legacy (EdgeHTML) is a different artefact

Pre-2020 Edge on Windows 10 used EdgeHTML and stored history in WebCacheV01.dat, an ESE database under C:\Users\<user>\AppData\Local\Microsoft\Windows\WebCache\. If you are investigating a host that was never updated past 2020, you are dealing with that format, not the Chromium one. The ESE engine is the same one behind SRUM.

Timestamps and WAL

Edge uses the Chromium WebKit epoch: microseconds since 1601-01-01 UTC. The WAL caveat from Chrome applies — collect History-wal and History-shm or accept that the last commits are gone.

Acquisition notes

  • Domain-joined hosts often have multiple managed profiles. Enumerate the User Data directory rather than assuming Default.
  • Edge's MSEdgeWebView2.exe (used by Teams, Outlook, etc.) has its own embedded profile under \Microsoft\EdgeWebView\User Data\. Worth a glance if you suspect activity inside a host application.

Further reading