---
tags:
  - Chrome
  - Edge
  - Firefox
  - Internet Explorer
  - Safari
  - SQLite
  - Web Browser

hide:
  - navigation
  - tags
---

# What pages did web browsers visit?

**ID**: Q1020


**Approaches to Answer**

-  [Collect URL visit records from local browser artifacts [Q1020.10]](#collect-url-visit-records-from-local-browser-artifacts)
    - Parse URL visit records from web browsers' own databases.
    - Tags: <span class="dfiqTag">Web Browser</span> <span class="dfiqTag">SQLite</span> <span class="dfiqTag">Chrome</span> <span class="dfiqTag">Safari</span> <span class="dfiqTag">Firefox</span> <span class="dfiqTag">Edge</span> <span class="dfiqTag">Internet Explorer</span>

# Approaches

!!! Note
    There are often multiple ways to approach answering a question.
    This section explains the approaches considered, how they work, and any
    benefits or drawbacks to each. All these approaches have different pros
    and cons. They can be used individually or in conjunction.

## Collect URL visit records from local browser artifacts
### 🗂️ Explanation
Most web browsers track URL visits (at least in non-Incognito/private sessions) in local artifacts on the system. We can collect and review these records. This approach is useful when you have remote access to a system (via GRR for example) or a disk image.

#### References
 - [Chrome](https://forensics.wiki/google_chrome/#history), [Firefox](https://forensics.wiki/mozilla_firefox/#history), and [Safari](https://forensics.wiki/apple_safari/#history) History on ForensicsWiki
 - [Web Browsers on ForensicArtifacts](https://github.com/ForensicArtifacts/artifacts/blob/main/data/webbrowser.yaml)

### 📝 Notes

Each approach comes with certain caveats or limitations. These can often
be tacit knowledge or assumed that "everyone knows that" (even though they
don't). This can lead to incorrect assumptions and analysis.
Explicitly stating what is covered and not covered by the approach reduces
ambiguity.

!!! success "Covered"

     - Chrome URL visits. Beyond "stable" Chrome, this also includes Chromium, Chrome Canary, Chrome Beta, and other Chromium-based browsers (Microsoft Edge, Brave, and Opera) on Windows, macOS, and Linux
     - Includes URL visits from all Chrome profiles
     - Firefox URL visits
     - Safari URL visits on Windows and macOS
     - Internet Explorer (4 - 10) URL visits

!!! failure "Not Covered"

     - Other Chromium-based browsers not specified above
     - Browsers installed in non-standard paths
     - Visits made in Incognito/Private sessions


### 💾 Data

The following data source(s) are needed for this approach to the question.

**Description**
:  Collect local browser history artifacts. These are often in the form of SQLite databases and JSON files in multiple directories.


**Type**
:  [ForensicArtifact](https://github.com/ForensicArtifacts/artifacts#digital-forensics-artifacts-repository)

**Value**
:  BrowserHistory ([view on GitHub](https://github.com/ForensicArtifacts/artifacts/search?q=BrowserHistory))

### ⚙️ Processors

A processor is what takes the [data](#💾-data) collected and processes it in
some way to produce structured data for an investigator to review. Multiple
processor options can be defined, as there are often multiple programs capable
of doing similar processing. Plaso is an example of a processor (it processes
raw artifacts into a timeline). After the data is processed, additional analysis
steps may be needed to answer the question.

The following processors can process the raw data specified above. Explicit
instructions on how to run the processor are *not* included here, but any
relevant configuration options are.


=== "Plaso"
    More information on [Plaso](https://forensics.wiki/plaso).

    Recommended options:

    ```
     --parsers webhist
    ```

    #### 📊 Analysis

    After processing the raw data, further analysis steps are necessary to answer
    the question. After loading Plaso's output into one of these
    analysis platforms, use the following steps to refine the data to answer the
    question.


    OpenSearch

    1. Filter the results to just URL page visits
       - OpenSearch query:

         ```
         data_type:("chrome:history:page_visited" OR "firefox:places:page_visited" OR "safari:history:visit_sqlite")
         ```

    Python Notebook

    1. Filter the results to just URL page visits
       - Python code:

         ```
         df.query('data_type in ("chrome:history:page_visited", "firefox:places:page_visited", "safari:history:visit_sqlite")')
         ```
=== "Hindsight"
    More information on [Hindsight](https://forensics.wiki/hindsight).

    Recommended options:

    ```
     --format jsonl
    ```

    #### 📊 Analysis

    After processing the raw data, further analysis steps are necessary to answer
    the question. After loading Hindsight's output into one of these
    analysis platforms, use the following steps to refine the data to answer the
    question.


    OpenSearch

    1. Filter the results to just URL page visits. Hindsight only supports Chromium-based browsers (including Microsoft Edge) and not Firefox or Safari.

       - OpenSearch query:

         ```
         data_type:"chrome:history:page_visited"
         ```

    Python Notebook

    1. Filter the results to just URL page visits. Hindsight only supports Chromium-based browsers (including Microsoft Edge) and not Firefox or Safari.

       - Python code:

         ```
         df.query('data_type == "chrome:history:page_visited"')
         ```
