Browser Artifacts
Install DB Browser for SQLite https://sqlitebrowser.org/dl/
History Locations:
Chrome: C:\Users\USERNAME\AppData\Local\Google\Chrome\User Data\Default\History
Edge: C:\Users\USERNAME\AppData\Local\Microsoft\Edge\User Data\Default\History
For Mac OS: Users//Library/Application Support/Google/Chrome/Default/History
Firefox: C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\downloads.sqlite
Read it locally with https://www.nirsoft.net/utils/mozilla_history_view.html
Artifact Locations:
Chrome Cache:
Most web browsers cache content from the sites that users browsed to, it can include pictures, text, html, javascript, etc. Historically this was used to avoid downloading the same images and content repeatedly when the same sites are visited frequently. Chrome stores cache content and information in three types of files: index, data_X, and f_XXXXXX files all under the cache folders. The data_X files will store cached content if the data is small but if it’s a larger image or other content, it will be pushed out to the f_XXXXXX.
Last updated
