Browser Profiles on Linux: Firefox and Chrome History

What it is

Browsers keep a per-user profile directory with SQLite databases and JSON files that record history, downloads, bookmarks, cookies, form data and session state. On Linux the layout is the same as on other platforms, but the profile location depends on how the browser was installed: distribution package, vendor package, snap or Flatpak. Missing the right directory is the most common reason browser evidence is "not found" on Ubuntu desktops, where Firefox and Chromium ship as snaps.

Where it lives

$XDG_CONFIG_HOME or $CHROME_CONFIG_HOME can move Chrome's root. Inside a Chromium-family root, profiles are Default, Profile 1, Profile 2...; Local State describes them. Firefox lists its profiles in profiles.ini and installs.ini next to the profile folders.

These paths are the same on Debian/Ubuntu, RHEL/Fedora and other families; the packaging choice (snap on Ubuntu, Flatpak when installed from Flathub) is what changes them.

What it proves

• Pages visited, how they were reached (typed, link, bookmark, redirect, download) and visit counts.
• Files downloaded, from which URL and referrer, where they were saved and whether they were opened (Chrome).
• Search terms typed into the address bar (Chrome keyword_search_terms).
• Open tabs and windows at a point in time (session files).

It does not prove who was at the keyboard, and synced profiles can contain visits made on another device (Chrome visits carries originator fields for synced rows). Private/incognito browsing is not written to these databases.

Key fields

Firefox places.sqlite

Other Firefox files: cookies.sqlite, formhistory.sqlite, favicons.sqlite, sessionstore.jsonlz4 and sessionstore-backups/recovery.jsonlz4 (LZ4-compressed JSON), extensions.json, prefs.js.

Chrome / Chromium History

Other Chromium files: Cookies, Web Data (autofill), Bookmarks (JSON), Preferences, Sessions/, Extensions/.

Timestamps

All are UTC. visit_duration in Chrome is a duration in microseconds, not a timestamp.

Retention

• Chrome/Chromium: history entries older than 90 days are expired automatically (kExpireDaysThreshold).
• Firefox: no fixed age. Places expiration trims old, low-frecency pages when the database grows beyond an optimal size (capped at 75 MiB) or places.history.expiration.max_pages.
• Users can clear history, set "clear on close", or browse privately. Deleted rows often survive in SQLite free pages and in -wal files until the database is vacuumed or checkpointed.

Collection

Close the browser or acquire from an image: live databases are locked and recent changes sit in the -wal or -journal file. Always copy the companions with each database.

UAC's files/browsers/* artifacts (in the full profile, not in ir_triage) cover Firefox, Chrome, Chromium, Edge, Brave, Opera and Vivaldi, including snap and Flatpak locations (the Chromium artifact covers only the snap and Flatpak paths, so copy a deb/rpm ~/.config/chromium yourself); caches are excluded by default (files/browsers/cache.yaml). Check your UAC version for the Firefox 147 ~/.config/mozilla/firefox path.

sudo ./uac -p full /mnt/usb/case42
# or targeted, from a read-only mount
cd /mnt/evidence
find home root -maxdepth 8 \( -name 'places.sqlite*' -o -name 'History' -o -name 'History-journal' \
  -o -name 'profiles.ini' -o -name 'Local State' -o -name '*.jsonlz4' \) -print0 | tar --null -T - -czf browsers.tgz

Parsing

• Hindsight (obsidianforensics/hindsight) parses Chromium-family profiles and, with -b Firefox, Firefox history, cookies and form history, into XLSX, JSONL or SQLite output. Point -i at a copied profile directory, for example hindsight.py -i ./google-chrome/Default -o case42-chrome -f jsonl.
• Plaso webhist preset includes sqlite/firefox_history, sqlite/firefox_downloads, sqlite/chrome_27_history, sqlite/chrome_66_cookies and cache parsers.
• sqlite3 on copies:

-- Firefox visits
SELECT datetime(v.visit_date/1000000,'unixepoch') AS utc, v.visit_type, p.url, p.title
FROM moz_historyvisits v JOIN moz_places p ON p.id = v.place_id ORDER BY v.visit_date;

-- Chrome downloads
SELECT datetime(start_time/1000000-11644473600,'unixepoch') AS utc, target_path, tab_url, referrer, received_bytes, opened
FROM downloads ORDER BY start_time;

Firefox jsonlz4 files start with the magic mozLz40\0; strip the 8-byte magic and 4-byte size, then LZ4-block-decompress (for example with the Python lz4 package).

Investigator tips

• On Ubuntu, check the snap paths first; a nearly empty ~/.mozilla next to a busy ~/snap/firefox is normal.
• Tie downloads to the filesystem: target_path or downloads/destinationFileURI gives the path to check for inode times, and files in /tmp or /dev/shm (see tmp and shm).
• Follow a file from download to use: download record, then recently-used.xbel for opening, then shell history for chmod +x or execution.
• A root-owned or service-account browser profile on a server is unusual and worth explaining.
• Run PRAGMA freelist_count; and carve free pages when history looks cleared.
• Browsers keep cookies and saved credentials in these profiles; collect them only when in scope, and do not attempt to decrypt credentials.