Browsers

FIreFox Profile location

XP %userprofile%\Applicaiton Data\Mozilla\Firefox\Profiles\XXXXXX.default

Vista Win7 %userprofile%\AppData\Roaming\Mozilla\Firefox\Profiles\XXXXX.default

Firefox Cache

XP %userprofile%\Local Settings\Applicaiton Data\Mozilla\Firefox\profiles\XXXXX.default\Cache

Vista Win7 %userprofile%\AppData\Local\Mozilla\Firefox\Profiles\XXXXXX.default\Cache

Firefox profiles use SQLite

places.sqlite - history, bookmarks, Auto-Complete

downloads.sqlite - Download history

formhistory.sqlite - Auto-Complete form data

cookies.sqlite - cookies

sigmons.sqlite - stored usernames and passwords

FIrefox type:

1. The user clicked on a link and a new window was opened

2. user typed the link

3. bookmark was used

4. dynamic content

5&6 Web page redirect

7. download link

IE location

Vista/Win7

History - %userprofile%\Local Settings\History\History.IE5

Cache - %userprofile%\Local Settings\Temporary Internet Files\Content.IE5

Cookies - %userprofile%\Cookies

Bookmarks - %userprofile%\Favorites

Low folders

%userprofile%\AppData\Local\Microsoft\History\Low\Hisotry.IE5\Low\History.IE5

Typed URLs (last 25)

HKCU\Software\Microsoft\InternetExplorer\TypedURLs

Protected storage

HKCU\Software\Microsoft\Protected Storage System Provider\<SID>

IE 7 +

HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage2

IE 10

%root%/Users/%userprofile%/AppData/Local/Microsoft/Windows /History

Internet Explorer History

• IE6-7 %USERPROFILE%\Local Settings\History\History.IE5

• IE8-9 %USERPROFILE%\AppData\Local\Microsoft\Windows\

History\History.IE5

• IE10-11 %USERPROFILE%\AppData\Local\Microsoft\Windows\

WebCache\WebCacheV*.dat

Chrome

• XP %USERPROFILE%\Local Settings\Application Data\

Google\Chrome\User Data\Default\History

• Win7/8/10 %USERPROFILE%\AppData\Local\Google\Chrome\

User Data\Default\History