Lion Cipher Lab
Reconstruct browsing and redirect chains from Firefox places.sqlite
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When someone clicks a phishing link, the question every investigation asks is the same: what did they click, where did it send them, and did anything get downloaded? Firefox writes the answer down, one row per visit, with a code for how each page was reached and a pointer to the visit that led to it. Most quick-look queries never see it, because they read the per-URL summary table, which collapses visits, leaves downloads with a visit count of zero, and shows only the most recent time a page was seen. Worse, the most recent activity, the incident itself, often lives in a sidecar file…
What you'll learn
- Reading Firefox's moz_historyvisits table as one row per visit, not one row per URL
- Decoding visit_type values 1-9 (LINK, TYPED, BOOKMARK, EMBED, the two REDIRECTs, DOWNLOAD, FRAMED_LINK, RELOAD) from Mozilla's own source
- Walking from_visit to rebuild a click -> redirect -> landing -> download chain
- Converting PRTime (microseconds since 1970 UTC) to readable timestamps
- Copying a SQLite database WITH its -wal sidecar, and measuring what you lose without it
- Choosing a SQLite open mode that neither ignores nor destroys the -wal
- Knowing why moz_places.visit_count and last_visit_date mislead a timeline
Steps in this lab
- When you reach for this - and what it cannot tell you
- The two tables that matter: places vs visits
- The visit_type codes, straight from Mozilla's source
- Build the fixture profile (and copy it two ways)
- Why the -wal file is part of the evidence
- Measure the open-mode trap before you trust any query
- Write the report script and compare the two copies
- Read the per-visit timeline like an examiner
- Walk the chain, then see what the per-URL view hides
- Optional: run the same report on a copy of your own history
- Honest limits - absence of a visit is not proof of no visit
- How a pro does it differently