SANS Digital Forensics and Incident Response Blog: Tag - history

Firefox 3 History

Analysis of a browser history almost always comes up, no matter what is being investigated. And despite Firefox being one of the most popular browsers currently used there aren't many tools out there that can read and display browser history (at least in a human readable format). There are tools out there, such as f3e from ( however that tool, just as others that I've found, is only distrubuted as an EXE, running on Windows (and no source code is provided).

Traditionally Firefox stored the history file as a Mork file format, which could be easily read using any standard editor. The new version, that is version 3 which has been out for quite some time now, uses a different method of storing user history. The history file is stored in a MozStorage format, as a