SBM Labs

Cyber Security Collaboration Project

Analysis of Mozilla Firefox browsing history
25 Aug 2014

1. Install add-on "SQLite Manager" for the browser Mozilla Firefox.

2. Open file places.sqlite.
- Ubuntu -> [user_home_directory]/.mozilla/firefox/xxxxxxxx.default/places.sqlite.
- Windows -> [user_home_directory]/AppData/Roaming/Mozilla/Firefox/Profiles/xxxxxxxx.default/places.sqllite.

3. Go to the tab "Execute SQL" and execute sql query.

SELECT visit_date, url FROM moz_historyvisits INNER JOIN moz_places ON moz_historyvisits.place_id = moz_places.id WHERE url LIKE '%url1%' OR url LIKE '%url2%' ORDER BY visit_date DESC

4. You should use function datetime() in order to convert timestamp to human view.

SELECT datetime(visit_date/1000000,'unixepoch','localtime') AS date, url FROM moz_historyvisits INNER JOIN moz_places ON moz_historyvisits.place_id = moz_places.id WHERE url LIKE '%url1%' OR url like '%url2%' ORDER BY date DESC

Analysis of Google Chrome browsing history