Scribd
Upload
47 views3 pages

Windows Browser Artifacts Cheat Sheet

This document is a cheat sheet detailing the locations of various artifacts for different web browsers on Windows, including Microsoft Edge, Google Chrome, Mozilla Firefox, and Internet Explorer. It provides specific file paths for user profiles, history, cookies, cache, sessions, and settings for each browser. The information is organized by browser type and includes both current and legacy versions.

Uploaded by

charles Assimti
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
47 views3 pages

Windows Browser Artifacts Cheat Sheet

This document is a cheat sheet detailing the locations of various artifacts for different web browsers on Windows, including Microsoft Edge, Google Chrome, Mozilla Firefox, and Internet Explorer. It provides specific file paths for user profiles, history, cookies, cache, sessions, and settings for each browser. The information is organized by browser type and includes both current and legacy versions.

Uploaded by

charles Assimti
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Windows Browser Artifacts Cheat Sheet

Microsoft Edge (Chromium-based)

User Profile:
%LocalAppData%\Microsoft\Edge\User Data\[Default|Profile X]\*

History (SQLite Database):


%LocalAppData%\Microsoft\Edge\User Data\[Default|Profile X]\History

Cookies (SQLite Database):


%LocalAppData%\Microsoft\Edge\User Data\[Default|Profile X]\Network\Cookies

Cache:
%LocalAppData%\Microsoft\Edge\User Data\[Default|Profile X]\Cache\*

Sessions:
%LocalAppData%\Microsoft\Edge\User Data\[Default|Profile X]\Sessions\*

Settings and Other Configuration:


%LocalAppData%\Microsoft\Edge\User Data\[Default|Profile X]\Preferences

Google Chrome

User Profile:
%LocalAppData%\Google\Chrome\User Data\Default\*

History (SQLite Database):


%LocalAppData%\Google\Chrome\User Data\Default\History

Cookies (SQLite Database):


%LocalAppData%\Google\Chrome\User Data\Default\Network\Cookies

Cache:
%LocalAppData%\Google\Chrome\User Data\Default\Cache\*

Sessions:
%LocalAppData%\Google\Chrome\User Data\Default\Sessions\*

Settings and Other Configuration:


%LocalAppData%\Google\Chrome\User Data\Default\Preferences

Version 1.0 youtube.com/13cubed


Windows Browser Artifacts Cheat Sheet

Mozilla Firefox

User Profile:
%AppData%\Mozilla\Firefox\Profiles\xxxxxxxx.default-release\*

History, Bookmarks, and Downloads (SQLite Database):


%AppData%\Mozilla\Firefox\Profiles\xxxxxxxx.default-release\places.sqlite

Cookies (SQLite Database):


%AppData%\Mozilla\Firefox\Profiles\xxxxxxxx.default-release\cookies.sqlite

Cache:
%LocalAppData%\Mozilla\Firefox\Profiles\xxxxxxxx.default-release\cache2\*

Sessions:
%AppData%\Mozilla\Firefox\Profiles\xxxxxxxx.default-release\sessionstore-
backups\*

Settings and Other Configuration:


%AppData%\Mozilla\Firefox\Profiles\xxxxxxxx.default-release\prefs.js

Legacy Browsers
Microsoft Edge

User Profile:
%LocalAppData%\Packages\Microsoft.MicrosoftEdge_XXX\AC

History, Cookies, and Downloads (ESE Database):


%LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat

Note that local file access will also appear within WebCacheV01.dat. Look for entries similar to:
file:///X:/path/to/file, where “X” is the drive letter on which the file was accessed.

Cache:
%LocalAppData%\Packages\Microsoft.MicrosoftEdge_XXX\AC#!XXX\MicrosoftEdge\Cache

Sessions:
%LocalAppData%\Packages\Microsoft.MicrosoftEdge_XXX\AC\MicrosoftEdge\User\Default
\Recovery\Active

Settings and Other Configuration:


%LocalAppData%\Packages\Microsoft.MicrosoftEdge_XXX\AC\MicrosoftEdge\User\Default
\DataStore\Data\nouser1\XXX\DBStore\spartan.edb

Version 1.0 youtube.com/13cubed


Windows Browser Artifacts Cheat Sheet

Microsoft Internet Explorer

Location of Most Artifacts (ESE Database):


%LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat

Artifact Database Container


History History
Cache Content
*Cookies (metadata only) Cookies
Downloads iedownload

*Cookies are stored in %AppData%\Microsoft\Windows\Cookies (and \Low)

Sessions:
%LocalAppData%\Microsoft\Internet Explorer\Recovery\*.dat

Version 1.0 youtube.com/13cubed

You might also like