Lion Cipher Lab
Extract browser forensic artifacts (history, downloads, cookies) with SQLite
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Almost every real digital-forensics or incident-response case involves a browser, because the browser is where a huge slice of what a person does actually happens — the sites they visited, the files they downloaded, the searches they ran, the accounts they logged into. And browsers write all of that down. History, downloads, cookies, and cache are not hidden magic: on Chrome, Edge, and Firefox they are stored in ordinary SQLite database files sitting in a folder called the profile directory, and anyone who knows where to look and how to read a database can reconstruct a strikingly detailed…
What you'll learn
- what a browser forensic artifact is and what an examiner can reconstruct from it
- finding the browser profile directory on Windows, macOS, and Linux (Chrome, Edge, Firefox)
- understanding that browser artifacts live in SQLite database files
- making a forensically sound copy so the original file is never altered
- opening a database read-only and listing its tables
- writing simple read-only SQL queries against history and downloads
- converting browser timestamp formats (WebKit/Chrome epoch and Unix epoch) into readable dates
- understanding the privacy weight of browser data, and the ethics of touching only your own
Steps in this lab
- First, the two rules that make this safe and sound
- What a browser artifact is, and what an examiner reconstructs
- What SQLite is, and getting a tool to read it
- Find your browser profile directory
- Close the browser, then make a forensic copy
- Open the copy read-only and list its tables
- Query your history and your downloads
- Make the timestamps readable (the epoch trick)
- Cookies, cache, and the weight of what you just saw
- Why this small skill is a real DFIR foundation