Mozilla Firefox 3 History File Format - Revision history

Minime2k10: /* Gathering browser history */

2011-09-13T10:38:04Z

‎Gathering browser history

Zoltantoth: In windows XP, FF stores its appdata in the folder Firefox (with _capital_ F)

2009-10-10T07:47:59Z

In windows XP, FF stores its appdata in the folder Firefox (with _capital_ F)

Kiddi: /* External Links */

2009-08-07T15:31:51Z

‎External Links

Kiddi at 17:27, 5 July 2009

2009-07-05T17:27:11Z

Kiddi at 17:26, 5 July 2009

2009-07-05T17:26:31Z

Simsong: /* File Locations */

2009-06-06T21:29:22Z

‎File Locations

Ktappe: /* File Locations */ Added Mac OS X path

2009-06-04T23:40:33Z

‎File Locations: Added Mac OS X path

Mikelococo: Improved SQLite statement to output dates in human readable format.

2009-03-16T23:52:42Z

Improved SQLite statement to output dates in human readable format.

Firefoxer: /* External Links */ - added another link to FF forensic utility

2008-09-24T19:11:32Z

‎External Links: - added another link to FF forensic utility

Firefoxer: /* Gathering browser history */ - added external links

2008-09-23T21:22:43Z

‎Gathering browser history: - added external links

@@ Line 73: / Line 73: @@
 ==Gathering browser history==
-Browser history for Firefox 3 can be gathered by connecting to the Sqlite database and performing simple queries.  For example, the URLs visited and the date and time of the visit can be gathered with this query:<pre>SELECT datetime(moz_historyvisits.visit_date/1000000,'unixepoch'), moz_places.url
+Live browser history for Firefox 3 can be gathered by connecting to the Sqlite database and performing simple queries.  For example, the URLs visited and the date and time of the visit can be gathered with this query:<pre>SELECT datetime(moz_historyvisits.visit_date/1000000,'unixepoch'), moz_places.url
 FROM moz_places, moz_historyvisits
 WHERE moz_places.id = moz_historyvisits.place_id</pre>

@@ Line 5: / Line 5: @@
 '''Windows XP'''
-C:\Documents and Settings\<username>\Application Data\Mozilla\firefox\Profiles\<profile folder>\places.sqlite
+C:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles\<profile folder>\places.sqlite
 '''Windows Vista'''

@@ Line 84: / Line 84: @@
 * [http://www.sqlite.org/ SQLite]
 * [http://blog.kiddaland.net/2009/07/firefox-3-history-revisited/ ff3histview]
 [[Category:File Formats]]

@@ Line 83: / Line 83: @@
 * [http://www.machor-software.com/firefox_forensics FireFox Forensics (F3) tool]
 * [http://www.sqlite.org/ SQLite]
-* [http://blog.kiddaland.net/2009/07/firefox-3-history-revisited/]
+* [http://blog.kiddaland.net/2009/07/firefox-3-history-revisited/ ff3histview]
 [[Category:File Formats]]

@@ Line 83: / Line 83: @@
 * [http://www.machor-software.com/firefox_forensics FireFox Forensics (F3) tool]
 * [http://www.sqlite.org/ SQLite]
 [[Category:File Formats]]

@@ Line 17: / Line 17: @@
 '''Mac OS X'''
-/Users/<user>/Library/Application\ Support/Firefox/Profiles/default.lov/places.sqlite
+/Users/<user>/Library/Application Support/Firefox/Profiles/default.lov/places.sqlite
 ==File Header==

← Older revision		Revision as of 23:40, 4 June 2009
Line 14:		Line 14:

	/home/<user>/.mozilla/firefox/<profile folder>/places.sqlite		/home/<user>/.mozilla/firefox/<profile folder>/places.sqlite
		+
		+	'''Mac OS X'''
		+
		+	/Users/<user>/Library/Application\ Support/Firefox/Profiles/default.lov/places.sqlite

	==File Header==		==File Header==

@@ Line 55: / Line 55: @@
 The place_id column of the moz_historyvisits table corresponds to the id column of the moz_places table.
-The visit_date column keeps time in [http://developer.mozilla.org/en/docs/PRTime PRTime] format, a 64-bit integer representing the number of microseconds since midnight (00:00:00) 1 January 1970 Coordinated Universal Time (UTC).  This level of precision may be more than what is required for a forensic application, but the PRTime format can easily be converted into CTime format by truncating everything after the 11th digit.
+The visit_date column keeps time in [http://developer.mozilla.org/en/docs/PRTime PRTime] format, a 64-bit integer representing the number of microseconds since midnight (00:00:00) 1 January 1970 Coordinated Universal Time (UTC).  This level of precision may be more than what is required for a forensic application, but the PRTime format can easily be converted into CTime format by dividing by 1,000,000.  The [http://www.sqlite.org/lang_datefunc.html datetime] function in SQLite can be used to convert CTime to human readable format, as demonstrated in the example below.
 The visit_type column is an integer that represents one of seven types.
@@ Line 69: / Line 69: @@
 ==Gathering browser history==
-Browser history for Firefox 3 can be gathered by connecting to the Sqlite database and performing simple queries.  For example, the URLs visited and the date and time of the visit can be gathered with this query:<pre>SELECT moz_places.url, moz_historyvisits.visit_date
+Browser history for Firefox 3 can be gathered by connecting to the Sqlite database and performing simple queries.  For example, the URLs visited and the date and time of the visit can be gathered with this query:<pre>SELECT datetime(moz_historyvisits.visit_date/1000000,'unixepoch'), moz_places.url
 FROM moz_places, moz_historyvisits
 WHERE moz_places.id = moz_historyvisits.place_id</pre>