Quick answer: Browser forensics reveals what a user did online from the traces the web browser leaves: addresses visited, search queries, downloaded files, saved sessions and cookies. These traces are one of the richest evidence sources showing a person's intent and actions, because people do most things through a browser. Chrome, Edge, Firefox and Safari mostly store their data in SQLite databases, so SQLite knowledge is fundamental to analysis. The critical point: "incognito" leaves fewer traces than assumed but not none; disk cache, memory and DNS records can still carry evidence. Deleted browser history can also be partly recovered from the database freelist.

One of the most frequently asked questions in an investigation is: what did this person look at, search for, go to? The answer is almost always in the browser. Much of modern life passes through a web browser, and the browser keeps a surprisingly detailed record of user behavior. This article explains where browser forensics finds which trace and how it is examined.

What traces the browser keeps

A web browser keeps many records the user is unaware of. The most valuable forensically:

Artifact What it shows
History Addresses visited, visit time and count
Search queries What the user searched, often the clearest proof of intent
Downloads Which file was downloaded from where and when
Cookies Which sites were logged into, identity traces
Cache Local copies of visited pages, deleted content may remain here
Saved sessions Sessions left open, authentication traces
Bookmarks and autofill Interests, entered addresses and form data
Tab history Closed tabs, session restore data

Most of these traces tell far more than what the user saw on screen at the moment: how many times a page was visited, when and in what order.

Where the data lives: SQLite

Modern browsers store their data largely in SQLite databases. Chrome and Edge (the same Chromium base) store history, cookies and downloads in separate SQLite files; Firefox similarly uses SQLite. So the language of browser forensics is SQLite: being able to open a database and read its tables is the fundamental skill of this field.

A critical detail: when a record is deleted in SQLite it often does not vanish immediately. Deleted history may remain as a remnant in the database freelist or the WAL (write ahead log) file. So saying "I cleared my history" does not mean the traces are entirely gone. The same SQLite recovery logic applies in mobile examination too; for detail, see our article on mobile forensics.

The incognito reality

A common misconception is that incognito leaves no trace. Incognito mode makes the browser not persistently save history and cookies, but not leaving a trace is another matter. These sources can still carry evidence:

  • Disk cache and swap. The operating system may have temporarily written browser data to disk.
  • Memory (RAM). Pages visited while the session is active exist in memory. For memory analysis, see our article on memory analysis with Volatility.
  • DNS records. The device's or the network's DNS cache can show the domains visited.
  • Network logs. Corporate proxy and DNS logs see incognito too.

So incognito reduces the browser's record but does not change the system's and the network's record.

The flow of a browser examination

  1. Take an image. The examination is done not on the live device but on an acquired image. For method, see our article on imaging with FTK Imager.
  2. Extract the databases. From the relevant browser's profile folder, take the history, cookie, download and cache files.
  3. Parse. Read the SQLite tables. Automated browser forensic tools render these tables into a readable timeline.
  4. Recover the deleted. Try to extract deleted records from the freelist and WAL file.
  5. Tie to a timeline. Combine browser activity with other artifacts (files, registry, email). For a comprehensive super timeline, see our article on timeline with Plaso.
  6. Verify and report. Confirm a critical finding with a second source and record it with chain of custody.

The registry also carries browser related traces (default browser, open URL traces); for detail, see our article on Windows Registry forensics.

Timestamps and pitfalls

  • Time zone. Browser timestamps can be kept in different formats and time zones. If not normalized correctly, the whole timeline shifts.
  • Visit count and type. How many times and how an address was visited (typed or clicked) matters in distinguishing intent.
  • Synchronization. Modern browsers sync data to the cloud. History seen on the device may include activity from other devices; this changes interpretation.
  • Multiple profiles. A browser may have multiple user profiles; which profile is examined must be clear.

Common mistakes

  • Thinking incognito leaves no trace. Disk, memory and network still carry evidence.
  • Thinking deleted history is gone. The freelist and WAL may hold remnants.
  • Working on the live device. The examination must be on an image, the original preserved.
  • Not normalizing the time zone. It shifts the timeline.
  • Ignoring cloud synchronization. History may have come from other devices.
  • Trusting a single source. A browser finding should be confirmed with registry and network logs.

Frequently asked questions

Can deleted browser history be recovered? Partly. Remnants may be found in the database freelist or WAL file. Cache, memory and DNS records also carry additional traces.

Is what I do in incognito completely private? No. Incognito reduces the browser's record but disk cache, memory, DNS and network logs can still carry evidence.

Where does browser data live? Mostly in SQLite databases in the browser's profile folder: history, cookies, downloads and cache in separate files.

Which browsers can be examined? Chrome, Edge, Firefox, Safari and all Chromium based browsers. Because their structures are similar, the method is largely shared.

How does cloud synchronization affect the examination? History seen on the device may include activity from the user's other devices. This complicates the question of which device an action was performed on.

Is browser analysis used in court? As long as it is collected properly, examined on an image and its integrity recorded with a hash, yes.

Sources

If you need to forensically examine a user's internet activity, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide browser forensics, incident response and expert reporting.