Mozilla Firefox is a freely available for download from the Mozilla website and is the second most frequently used Internet browsing software with approximately 10% of usage, behind Google Chrome with nearly 80%.
Mozilla Firefox stores Internet activity and related information within 12 different Sqlite database files named content-prefs.sqlite, formhistory.sqlite, search.sqlite, signons.sqlite, permissions.sqlite, chromeappstore.sqlite, downloads.sqlite, extensions.sqlite, places.sqlite, webappsstore.sqlite, addons.sqlite and cookies.sqlite.
Depending upon the version of Mozilla Firefox, the databases are located within the Application directory which is held within different paths depending upon the operating system. The latter versions of the Windows operating system stores them within the \Users\Profile\AppData\Roaming\Mozilla\Firefox\Profiles\ directory, the earlier versions store them within the \Documents and Settings\Profile\Application Data\Mozilla\Firefox\ directory, the Mac OSX operating system stores them within the path \Library\Application Support\Mozilla\Firefox\Profiles and Linux within \.config\mozillafirefox\Default\databases.
The most useful sqlite databases to consider when conducting a computer forensic examination of Mozilla Firefox are the following:
Downloads.sqlite contains the history of files downloaded through Mozilla Firefox including the time/date of the download, the folder that they were stored to and the source of them. This can be useful when attempting to identify the source of a downloaded image or file.
The formhistory.sqlite file contains information input into website forms within Mozilla Firefox, which can include email addresses, user names, names, addresses and phone numbers which can be useful in establishing the specific individual sat at the computer at a given time.
Cookies.sqlite contains all automatically generated cookie files during the use of Mozilla Firefox, including analytics, advertisements and site configuration settings. These can be useful in establishing which websites were visited, however, they can be created without the site being visited and therefore caution should be taken with them.
The places.sqlite file contains all Mozilla Firefox bookmarks, downloaded files and websites visited, including the time/date and website addresses (URL’s) relating to that activity. This can be useful in establishing the path taken by the user to encounter a particular website or page.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0845 882 7386 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensics investigation.
Our digital forensics experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years.
Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
https://athenaforensics.co.uk/
https://athenaforensics.co.uk/service/computer-forensic-experts/
https://athenaforensics.co.uk/service/mobile-phone-forensic-experts/
