Difference between pages "Mozilla Firefox" and "File:3-samsung-s3-sgh-i747m-disassembly-screws.jpg"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Cache)
 
 
Line 1: Line 1:
{{expand}}
 
Mozilla Firefox is a Free and Open Source [[Web Browser|web browser]] developed by the Mozilla Foundation.
 
  
It can have many [http://addons.mozilla.org add-ons] which give it extra capabilities.
 
 
== Anonymous Browsing ==
 
Mozilla Firefox can be used in anonymous browsing (see [[The Onion Router]]). However, it is known that Firefox reveals computer's uptime in TLS (SSL) "Client Hello" packets allowing investigator correlate anonymous and non-anonymous traffic [http://archives.seul.org/or/talk/Apr-2008/msg00050.html].
 
 
This bug affects Firefox 2 (all versions) and Firefox 3 Beta3.
 
 
== History ==
 
Firefox 3 stores the history of visited sites in a file named '''places.sqlite'''. This file uses the [[SQLite database format]].
 
 
'''places.sqlite''' can be found in the following locations:
 
 
On Linux
 
<pre>
 
/home/$USER/.mozilla/firefox/$PROFILE.default/places.sqlite
 
</pre>
 
 
On MacOS-X
 
<pre>
 
/Users/$USER/Library/Application Support/Firefox/Profiles/$PROFILE.default/places.sqlite
 
</pre>
 
 
On Windows XP
 
<pre>
 
C:\Documents and Settings\%USERNAME%\Application Data\Mozilla\Firefox\Profiles\%PROFILE%.default\places.sqlite
 
</pre>
 
 
On Windows Vista, 7
 
<pre>
 
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\%PROFILE%.default\places.sqlite
 
</pre>
 
 
=== Timestamps ===
 
The places.sqlite uses the following timestamps.
 
 
The '''moz_historyvisits.visit_date''' is in (the number of) microseconds since January 1, 1970 UTC
 
 
Some Python code to do the conversion into human readable format:
 
<pre>
 
date_string = datetime.datetime( 1970, 1, 1 )
 
            + datetime.timedelta( microseconds=timestamp )
 
</pre>
 
 
=== Example queries ===
 
Some example queries:
 
 
To get an overview of the visited sites:
 
<pre>
 
SELECT datetime(moz_historyvisits.visit_date/1000000, 'unixepoch', 'localtime'), moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id;
 
</pre>
 
 
== Downloads ==
 
Firefox 3 stores the history of downloads sites in a file named '''downloads.sqlite'''. This file uses the [[SQLite database format]].
 
 
'''downloads.sqlite''' can be found in the same location as '''places.sqlite'''.
 
 
'''Note it looks that Firefox 21 (or earlier?) stores the downloads as part of the bookmarks in moz_bookmarks and moz_annos in places.sqlite'''
 
 
=== Timestamps ===
 
The places.sqlite uses the following timestamps.
 
 
The '''moz_downloads.startTime''' and '''moz_downloads.endTime''' are in (the number of) microseconds since January 1, 1970 UTC.
 
 
=== Example queries ===
 
Some example queries:
 
 
To get an overview of the downloaded files:
 
<pre>
 
SELECT moz_downloads.startTime, moz_downloads.source, moz_downloads.currBytes, moz_downloads.maxBytes FROM moz_downloads;
 
</pre>
 
 
== Cache ==
 
On Linux
 
<pre>
 
/home/$USER/.mozilla/firefox/$PROFILE.default/Cache/
 
</pre>
 
 
On MacOS-X
 
<pre>
 
/Users/$USER/Library/Caches/Firefox/Profiles/$PROFILE.default/Cache/
 
</pre>
 
 
On Windows XP
 
<pre>
 
C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Mozilla\Firefox\Profiles\%PROFILE%.default\Cache\
 
</pre>
 
 
On Windows Vista, 7
 
<pre>
 
C:\Users\%USERNAME%\AppData\Local\Mozilla\Firefox\Profiles\%PROFILE%.default\Cache\
 
</pre>
 
 
== See Also ==
 
 
* [[Mozilla Suite]]
 
* [[Mozilla Firefox History File Format]]
 
* [[SQLite database format]]
 
 
== External Links ==
 
 
* [http://www.mozilla.com/firefox/ Official website]
 
* [http://kb.mozillazine.org/Profile_folder_-_Firefox Profile folder - Firefox]
 
* [https://wiki.mozilla.org/images/3/3d/Downloads.sqlite.schema.pdf Firefox 3 – downloads.sqlite]
 
* [http://download.cdn.mozilla.net/pub/firefox/releases/ Mozilla Firefox Releases]
 
 
[[Category:Applications]]
 
[[Category:Web Browsers]]
 

Latest revision as of 17:10, 23 January 2014