Skip to content

🦊 Firefox Artifacts Extraction

🎯 Objective

The goal of Firefox forensics is to trace user activity on the system through browsing records, cookies, bookmarks, form data, and login data.\ These artifacts help determine:

  • Browsing history

  • Cookies

  • Bookmarks

  • Form input data

  • Login credentials

They are used to:

  • Track user’s online activity

  • Accurately determine browsing behavior and timeline

  • Detect attempts to hide evidence such as history deletion or private browsing

  • Uncover illegal use like:

  • Accessing stolen accounts

  • Visiting hacking or leak sites

  • Downloading suspicious tools

🧪 Practical Scenarios

We are analyzing Firefox data in one of the following scenarios:

Scenario Type Description
🟢 Live Analysis The system is running, and we’re analyzing directly.
🔵 Mounted Analysis Analyzing a disk or disk image from another system (e.g., in SIFT Workstation).

📍 Firefox Artifact Paths on Linux Systems

🔹 Ubuntu / Linux Mint (when installed via Snap):

/home/USERNAME/snap/firefox/common/.mozilla/firefox/

  • Contains profile folders and SQLite databases

  • Snap runs in a sandbox, hence different path

🔹 Kali / SIFT (when installed via apt):

/home/USERNAME/.mozilla/firefox/  

cd /home/as/.mozilla/firefox/i8moxwwr.default-esr  

cd /home/sansforensics/.mozilla/firefox/xn53uh5w.default-release/

  • Default path for apt-based installations

  • Used in distros like Kali and SIFT

  • In SIFT, evidence paths are often mounted as:

/mnt/evidence/home/USERNAME/.mozilla/firefox/

🔍 DF Tip: Always make sure the image is mounted properly and work on a copy, not the original.

📂 Profile Folder Components

Inside folders like:

xxxxxxxx.default-release or xxxxxxxx.default-esr

You’ll find key databases:

File Description
places.sqlite 🔥 Main database: browsing history + bookmarks
cookies.sqlite Stores cookies: sessions, site settings
favicons.sqlite Site icons – visual context of activity
formhistory.sqlite Form input history (e.g., search terms)
webappsstore.sqlite LocalStorage data for web apps
logins.json + key4.db Saved login data – encrypted and need key to decrypt 
cd /home/as/.mozilla/firefox/i8moxwwr.default-esr  ls *.sqlite *.json *.db

If files aren't found, try:

cd /home/as/.mozilla/firefox/yi64xyq1.default

🛠️ Practical Analysis Steps

✅ 1. Locate Relevant Files

find /home -type f -name "places.sqlite"

✅ 2. Copy Files for Analysis

cp /home/USERNAME/.mozilla/firefox/xxxxxxxx.default-release/places.sqlite ~/Desktop/

✅ 3. Analyze with SQLite Viewer

Key tables inside:

Table Purpose
moz_places Visited URLs
moz_historyvisits Links URL to visit timestamps
moz_bookmarks User’s saved bookmarks
moz_bookmarks_deleted Deleted bookmarks (very important)
moz_inputhistory Typed entries in address bar
moz_keywords Bookmark keywords
moz_places_extra Extra visit data
moz_historyvisits_extra Time spent on site
moz_origins Domain origins

💡 Tip: Join moz_places and moz_historyvisits for a timeline view of user activity.

🔍 Advanced Tools for Firefox Artifacts Analysis

Tool Functionality
sqlite3 Quick command-line analysis
Browser History Examiner Visual browsing history analysis (Windows)
Hindsight (by Obsidian) Open-source Python tool to analyze browser history and generate reports
Autopsy Forensics suite with built-in browser module

🧠 What Can Firefox Forensics Reveal?

  1. Visited websites and timestamps

  2. Bookmark analysis to reveal sites of interest

  3. Cookie analysis to extract:

  4. Active sessions

  5. Site tracking artifacts

  6. Temporal correlation between browsing and other system events

  7. Detection of concealment attempts (private mode – history deletion)

💡 Pro Tips in Digital Forensics

  • 🧪 Always work on a readonly copy

  • 📅 Use stat to check file timestamps:

stat places.sqlite

  • 🔗 Correlate findings with:

  • Bash history

  • System logs (/var/log/syslog)

  • USB activity logs

  • 👥 Check all profiles — there may be multiple users

🔗 Practical Example: Visit Timeline

Opening the file using SQLite

✳️ Option 1: Terminal using sqlite3
sqlite3 ~/Desktop/places.sqlite

Inside SQLite, run:

SELECT 
    moz_places.url, 
    datetime(moz_historyvisits.visit_date/1000000,'unixepoch') AS visit_time 
FROM 
    moz_places, moz_historyvisits 
WHERE 
    moz_places.id = moz_historyvisits.place_id 
ORDER BY 
    visit_time DESC 
LIMIT 20;

To exit SQLite:

.exit
📌 Why divide timestamp by 1,000,000?

Because visit_date is stored in microseconds since the Unix epoch.\ To convert to seconds (for datetime(...,'unixepoch')), you must divide by 1,000,000.

✅ End Result?

You'll extract the last 20 visited websites along with their timestamps – extremely useful in building a user activity timeline during investigation.

📊 Summary of File Analysis Outputs

Artifact Type What It Reveals
moz_places Visited websites
moz_historyvisits Visit timestamps and durations
moz_bookmarks User’s bookmarked/favorite sites
moz_bookmarks_deleted Bookmark deletion attempts
cookies.sqlite Active sessions – possible account access
logins.json + key4.db Logged-in accounts (even if history is deleted)
formhistory.sqlite Search terms and form data

🧰 Additional Useful Tools

Tool Use Case
sqlite3 Fast terminal-based analysis
SQLite Viewer Visual SQLite analysis
Browser History Examiner Powerful GUI tool (Windows)
Autopsy Comprehensive forensics platform with browser support
Hindsight Python tool to analyze Chrome and Firefox with timeline reporting