Browser History & Downloads

Location

Description

SQLite databases for Chrome, Edge, and Firefox storing visited URLs with timestamps, download records with source URL and target path, search queries, and form autofill data.

Forensic Value

Browser history reveals initial access vectors such as phishing URLs and drive-by download sites. Download records link a malicious file to the exact URL it was fetched from and the time of download. Search queries may show attacker reconnaissance activity (searching for sensitive shares, admin portals). Multiple browser profiles may need to be checked.

Tools Required

Collection Commands

kape.exe --tsource C: --tdest C:\output --target WebBrowsers

hindsight.py -i "C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default" -o C:\output\chrome_history

BrowsingHistoryView.exe /scomma C:\output\browser_history.csv

sqlite3 "C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\History" "SELECT url, title, datetime(last_visit_time/1000000-11644473600,'unixepoch') FROM urls ORDER BY last_visit_time DESC"

Collection Constraints

• •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.

MITRE ATT&CK Techniques

References