Browser history

Location & availability

The actual Chrome/Edge profile History database or Firefox places.sqlite, with companion files

Schemas and timestamp epochs vary by browser and version. Private browsing and retention settings affect coverage.

Fields to examine

• URL, title and visit records supported by the schema.
• Profile identity, visit transitions and source context.
• Timestamp values converted using the correct epoch.

What it can establish

• Support a recorded visit-related entry in the examined browser profile.

What it cannot prove

• Prove the user read a page, downloaded its payload or ran a program.
• Attribute a synchronised or background entry automatically to a local human action.

Use it in a screenshare

1. Ask the player to identify the browser and relevant profile before inspecting default folders. Preserve a consistent database copy and available WAL files.
2. Use a schema-aware parser or queries against a copy. Validate timestamp conversions against known records.
3. Connect a candidate URL to download records and retained files. Limit the examination to relevant hosts and times.

Worked example

A visit record references a tool’s release page. That supports recorded browsing context. A successful download and subsequent execution require separate evidence from download state, file identity and a run artifact.

Cross-check the finding

• Browser download records →Support a recorded transfer attempt and, when recorded, its completion state.
• Zone.Identifier / Mark of the Web →Support retained zone/origin metadata attached to that file.
• Prefetch →Support execution of an associated executable within the retained history.

Sources

• Chromium — profile data directories ↗
• SQLite — write-ahead logging ↗