SANS Digital Forensics and Incident Response Blog: Tag - firefox

Firefox 3.X Forensics: Using F3e

In my current role as a corporate investigator, I tend to review web browser histories in most of my cases. Due to that, I am always looking for additional tools to review web browser histories and I think Mr. Chris Cohen has written a nice one for Firefox 3.X.

A little background on Firefox....

Firefox 3.X uses a SQLite databases to store:

  • Internet browsing history
  • Bookmarks
  • Settings
  • Downloads
  • Cookies
  • Form History
  • and more.

As you can see it can be a treasure trove of data in the various SQLite files such as downloads.sqlite, formhistory.sqlite, places.sqlite, and etc. Sometimes finding a good tool to extract the data can be challenging.

Mr. Chris Cohen has written a freeware tool called Firefox 3 Extractor or f3e for short. F3e can

... Continue reading Firefox 3.X Forensics: Using F3e