Extracting metadata from web browsers

In the following section, we are going to analyze how to extract metadata such as downloads, history, and cookies from the Chrome and Firefox web browsers.

Firefox forensics with Python

Firefox stores browser data in SQLite databases whose location depends on the operating system. For example, in the Linux operating system, this data is located at /home/<user>/.mozilla/Firefox/.

For example, in the places.sqlite file, we can find the database that contains the browsing history, and it can be examined using any SQLite browser. In the following screenshot, we can see the SQLite browser with the tables available in the places.sqlite database:

Figure 12.1: The places.sqlite database

We could build a Python script that extracts information from the moz_downloads, moz_cookies, and moz_historyvisits tables. We are getting downloads from the moz_downloads table, and for each result, we print information about the filename...