Mozilla Firefox – Basics

Mozilla Firefox was the most popular back in 2011, and although its popularity has been surpassed by Google Chrome (which I will cover later), it still holds around a quarter of the internet’s browser base.

With Windows 7 there were some changes made to the location of browser artefacts. Firefox artefacts are now located:


  • History
  • Cookies
  • Bookmarks
  • Auto-Complete



  • Cache

The AppData folder is hidden by default, this can be addressed using Folder Options from the ‘tools’ menu in any open Explorer window (press Alt to show menu)

The <randomstring>.default folder is a profile, there may be more than one profile per user.

SQLite files

There are several SQLite files which are of interest during an investigation, although these can be parsed with nothing but an SQLite viewer it is recommended to use a specific parser for the SQLite file you are investigating. The SQLite parser can be used to confirm critical or incriminating evidence.


This table shows each of the SQLite databases for Firefox and what each one contains.

That’s it for an introduction to Firefox, stay tuned, same geek time, same geek channel!!

This entry was posted in Browser Forensics, Firefox and tagged , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s