Lion Cipher Lab
Examine browser artifacts (on your own profile)
- Digital Forensics & IR (DFIR)
- Beginner
- ~40 min
- Free · no account required
Why it matters
Browsers are where a huge amount of what people do online lives, which makes browser artifacts some of the most valuable evidence in digital forensics and incident response: history shows what sites were visited and when, downloads show what files arrived, and cookies and cache show sessions and activity. Knowing where these artifacts are stored, that they're mostly ordinary SQLite databases you can read, and how to interpret their timestamps is a core DFIR skill — and the safest way to learn it is on your own profile, where you already know the ground truth of what you did. It also drives…
What you'll learn
- where browsers store history/downloads/cookies
- reading a SQLite artifact database
- working on a copy, not the live profile
- interpreting timestamps and visit data
- using a purpose-built browser-forensics tool
Steps in this lab
- The rule: your own profile, on a copy
- Find where the artifacts live
- These are just SQLite databases
- Read the history and downloads
- Decode the timestamps
- Let a purpose-built tool do the heavy lifting
- Why the browser is a forensic goldmine