browserforensics
← Back to all articles

Where browsers store their artifacts

2026-05-18 · 2 min

Most user-facing browser data is SQLite. That is good news: you can open the databases read-only and query them without touching the live browser. Bookmarks, sessions and preferences usually sit in JSON or plist sidecars, and web-app state (LocalStorage, IndexedDB) is in LevelDB folders. Knowing which file holds what saves time when you are paging through a profile folder under pressure.

Chromium family (Chrome, Edge, Brave, Vivaldi, Opera)

Inside the profile directory (Default, Profile 1, …):

  • History — urls, visits, downloads, downloads_url_chains, keyword_search_terms.
  • Cookies — moved into Network/Cookies in recent builds. Values are AES-GCM ciphertext keyed by DPAPI on Windows and the Keychain on macOS.
  • Web Data — autofill, autofill_profiles, payment methods.
  • Login Data — logins. Username plain, password ciphertext.
  • Top Sites, Favicons — SQLite.
  • Bookmarks, Preferences, Secure Preferences — JSON.
  • Local Storage/leveldb/, Session Storage/, IndexedDB/<origin>.indexeddb.leveldb/ — LevelDB key-value stores. See Local Storage and IndexedDB.

Timestamps across these SQLite files are microseconds since 1601-01-01 UTC, with the lone exception of autofill which uses Unix seconds.

Firefox

The profile lives under a randomly-named folder (xxxxxxxx.default-release).

  • places.sqlite — history (moz_places, moz_historyvisits), bookmarks (moz_bookmarks), downloads annotations.
  • cookies.sqlite — moz_cookies. Values are plain.
  • formhistory.sqlite, favicons.sqlite, webappsstore.sqlite.
  • logins.json plus key4.db — credentials, encrypted with the profile master key (often blank, often recoverable).
  • sessionstore.jsonlz4, recovery.jsonlz4 — Mozilla LZ4-wrapped JSON of open and recently closed tabs.

Firefox timestamps are microseconds since the Unix epoch. moz_cookies.expiry is the exception: plain seconds.

Safari

Split between ~/Library/Safari and the com.apple.Safari container.

  • History.db — history_items, history_visits.
  • Bookmarks.plist, Downloads.plist, LastSession.plist, RecentlyClosedTabs.plist — binary plists.
  • Cookies.binarycookies — Apple's bespoke cookie format. Plain values.
  • favicons.db, Touch Icons Cache.db — SQLite.

Safari uses Mac absolute time: seconds (often fractional) since 2001-01-01 UTC.

What to grab and in what order

For a profile acquisition, copy the whole profile folder and its -wal / -shm SQLite sidecars. Recent commits live in the WAL — skip it and you miss the last few minutes of activity, which is often exactly what you care about. The WAL recovery post covers the mechanics.

Cross-reference cookies and history with the MFT for file-level timestamps, the USN journal for delete/rename history, and EVTX (Microsoft-Windows-Application-Experience, PowerShell 4104) for any scripted cleanup that ran against the profile.

Further reading