Mozilla Firefox was the most popular back in 2011, and although its popularity has been surpassed by Google Chrome (which I will cover later), it still holds around a quarter of the internet’s browser base.

With Windows 7 there were some changes made to the location of browser artefacts. Firefox artefacts are now located:

%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomstring>.default

• History
• Cookies
• Bookmarks
• Auto-Complete

and

%USERPROFILE%\AppData\Local\Mozilla\Firefox\Profiles\<randomstring>.default\cache

• Cache

The AppData folder is hidden by default, this can be addressed using Folder Options from the ‘tools’ menu in any open Explorer window (press Alt to show menu)

The <randomstring>.default folder is a profile, there may be more than one profile per user.

SQLite files

There are several SQLite files which are of interest during an investigation, although these can be parsed with nothing but an SQLite viewer it is recommended to use a specific parser for the SQLite file you are investigating. The SQLite parser can be used to confirm critical or incriminating evidence.

This table shows each of the SQLite databases for Firefox and what each one contains.

That’s it for an introduction to Firefox, stay tuned, same geek time, same geek channel!!