Firefox Forensics Summary

Windows Forensics Overview

  • Focus on web browser forensics, specifically for Firefox.

Possible Firefox Evidence Items

  • Installation artifacts

  • User artifacts:

  • Accounts

  • Settings/Preferences

  • History

  • Typed URLs

  • Bookmarks

  • Cookies

  • Internet cache

  • Downloads

  • Auto-complete/Form Data

  • Password Recovery

/

Installation Artifacts

  • Program Files Locations:

  • C:\Program Files\Mozilla Firefox

  • C:\Program Files (x86)\Mozilla Firefox

  • Files include:

  • .dll, .ini, .exe files related to installation/removal.

  • EULA, ReadMe, Profile Manager, installation logs.

  • Preloaded plug-ins, bookmarks, thematic files.

Installation Log File (install.log)

  • Located in Mozilla Firefox folder; provides:

  • Install date/time.

  • Destination path for installed resources.

  • Specific components installed.

Firefox Artifacts: User Directory

  • User account structure:

  • Users\username\AppData\Local\Mozilla

  • Users\username\AppData\Roaming\Mozilla

  • Stores:

  • Browsing history

  • Cached files

  • Download settings

  • Preferences

User Preferences

  • General Tab: Adjust settings (homepage, downloads).

  • Privacy Tab: Storage preferences for history, cookies, personal information.

  • Security Tab:

  • Password management, including options to remember passwords.

  • Master Password option for additional security.

Stored Web Site Authentication

  • Passwords stored in signons.txt or signons.sqlite files, encrypted using key3.db.

Key Artifact Files

  • formhistory.sqlite: Stores auto-complete data.

  • places.sqlite: Holds browser history and bookmarks.

  • cookies.sqlite: Contains cookie data, tracking:

  • Source

  • Expiration date

  • prefs.js: Contains browser preferences (e.g., default directory, network settings).

  • downloads.sqlite: Tracks download source and destination.

  • Cache Directory: Equivalent to Temporary Internet Files; contains components of downloaded web pages.

  • Path: Users\username\AppData\Local\Mozilla\Firefox\Profiles\randomID.profilename\Cache