This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn
Mozilla Firefox is a Free and Open Source web browser developed by the Mozilla Foundation.
It can have many add-ons which give it extra capabilities.
Mozilla Firefox can be used in anonymous browsing (see The Onion Router). However, it is known that Firefox reveals computer's uptime in TLS (SSL) "Client Hello" packets allowing investigator correlate anonymous and non-anonymous traffic .
This bug affects Firefox 2 (all versions) and Firefox 3 Beta3.
Firefox 3 stores the history of visited sites in a file named places.sqlite. This files uses the SQLite database format.
places.sqlite can be found in the following locations:
On Windows XP
C:\Documents and Settings\%USERNAME%\Application Data\Mozilla\Firefox\Profiles\%PROFILE%.default\places.sqlite
On Windows Vista, 7
The places.sqlite uses the following timestamps.
The visit date and time values in the moz_historyvisits table are in (the number of) microseconds since January 1, 1970 UTC
Some Python code to do the conversion into human readable format:
date_string = datetime.datetime( 1970, 1, 1 ) + datetime.timedelta( microseconds=timestamp )