skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

extracting-browser-history-artifacts

Extract browser history, cookies, downloads, and bookmarks from Chrome, Firefox, and Edge forensic images.

954|172|Updated Mar 13, 2026
Search Tags:#sqlite#incident response#digital forensics#artifact extraction#chrome history#Hindsight#browser forensics
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill extracting-browser-history-artifacts
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: extracting-browser-history-artifacts
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/digital-forensics/extracting-browser-history-artifacts
Command: npx skills add https://github.com/xalgord/xalgorix --skill extracting-browser-history-artifacts

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyhindsight.

What problem does it solve?

Forensic investigators need to reconstruct a user's web activity from disk images, but browser artifacts are scattered across SQLite databases with different schemas, timestamp epochs, and encryption schemes. This Skill provides a structured workflow to locate, extract, and analyze browser artifacts from Chrome, Firefox, and Edge without missing critical evidence like WAL files or deleted records.

Core Features & Use Cases

  • Multi-Browser Artifact Extraction: Query Chrome History, Firefox places.sqlite, and Edge databases for history, downloads, cookies, bookmarks, and saved logins using sqlite3.
  • Timestamp and Schema Handling: Correctly converts Chrome's 1601-epoch microseconds and Firefox's Unix-epoch microseconds, and accounts for SQLite WAL files containing deleted or uncommitted records.
  • Automated Chrome Analysis with Hindsight: Runs pyhindsight against Chrome profiles to produce consolidated XLSX or JSONL reports covering history, cache, autofill, and extensions.
  • Use Case: During a phishing investigation, extract the victim's browser history around the reported timeframe, identify the malicious URL visited, check downloads for the payload, and correlate findings with network logs.

Quick Start

Extract and analyze the Chrome and Firefox browsing history from the mounted forensic image at /mnt/evidence and produce CSV reports of history, downloads, and cookies.

Frequently Asked Questions about extracting-browser-history-artifacts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract Chrome browsing history from a forensic image?▼

Chrome history is stored in the History SQLite database under the user's profile directory. Query the urls and visits tables with sqlite3, converting timestamps with datetime(last_visit_time/1000000-11644473600, 'unixepoch') to get human-readable visit times.

How to convert Chrome and Firefox timestamps in SQLite forensics?▼

Chrome and Edge store timestamps as microseconds since 1601-01-01, so divide by 1000000 and subtract 11644473600. Firefox uses microseconds since the 1970 Unix epoch, so divide by 1000000 only. Mixing the two produces wildly incorrect dates.

Does incognito or private browsing leave history artifacts?▼

Chrome Incognito and Firefox Private Browsing do not write records to the History or places.sqlite databases. Absence of a URL is not proof it was never visited, so corroborate with DNS resolver caches, proxy logs, or firewall records.

What is the SQLite WAL file in browser forensics?▼

The Write-Ahead Log (History-wal, places.sqlite-wal) holds recently committed and uncommitted records not yet merged into the main database, including deleted rows. Always collect the WAL alongside the database or a checkpoint may silently merge or lose that state.

Can I recover deleted browser history from SQLite databases?▼

Deleted rows often survive in freelist pages and unallocated space within the SQLite database file. Use a SQLite record carver to recover them, and check the WAL file which may still contain records deleted from the main database.

Why are Chrome saved passwords unreadable after extraction?▼

Chrome encrypts stored passwords and cookies with DPAPI on Windows or the keychain on macOS, tied to the user's master key. You can extract login URLs and usernames from the Login Data database, but decrypting passwords requires the user's credentials.

Related Skills

Explore More Software Engineering Skills→
FuzzdkkFuzzdkk
3

evidence-acquisition

Acquire and preserve digital evidence with hash verification and chain-of-custody logging.

Community
Advanced
YukiIto1999YukiIto1999

dfir

Analyzes Windows event logs, PCAPs, and filesystem artifacts to detect security incidents.

Community
Advanced
idemeumidemeum

network-reset

Diagnose and repair Wi-Fi and local network connectivity failures.

Official
Advanced
xjtu-wangxjtu-wang
4

competition-pcap-protocol

Reconstruct TCP/UDP sessions from PCAP captures and decode HTTP, WebSocket, and DNS protocols.

Community
Advanced