Individual skill
extracting-browser-history-artifacts
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
internal/tools/skills/data/digital-forensics/extracting-browser-history-artifacts/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,310
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- forensics Declared skill tag
- browser-forensics Declared skill tag
- chrome Declared skill tag
- firefox Declared skill tag
- edge Declared skill tag
- web-history Declared skill tag
- artifact-extraction Declared skill tag
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Extracting Browser History Artifacts
## When to Use
- When investigating user web activity as part of a forensic examination
- During insider threat investigations to establish patterns of data exfiltration
- When tracing user visits to malicious or policy-violating websites
- For correlating browser activity with other forensic artifacts and timelines
- When investigating phishing attacks to identify which links were clicked
## Detection Gaps & Validation
- **Incognito/private mode leaves no history row.** Chrome Incognito and Firefox Private Browsing do not write to `History`/`places.sqlite`. Absence of a URL is not proof it was not visited — pivot to network-side evidence.
- **Most-missed source: the SQLite WAL.** `History-wal`/`places.sqlite-wal` (and `-shm`, rollback journals) hold recently committed *and* uncommitted records that the main DB lacks. Collect the WAL alongside the DB, or a checkpoint on open will silently merge/lose state. Deleted rows also survive in freelist/unallocated DB pages (recover with a SQLite record carver).
- **Epoch pitfalls:** Chrome/Edge timestamps are microseconds since **1601-01-01** (`/1000000 - 11644473600`); Firefox is microseconds since **1970**. Mixing them produces wildly wrong times.
- **Sync contamination:** a signed-in profile can pull history/bookmarks from *other* devices, so a URL in the DB was not necessarily visited on this machine.