Places.sqlite
Definition
Firefox's combined history and bookmarks store. Visit timestamps are PRTime (microseconds since 1 January 1970). cookies.sqlite, formhistory.sqlite, key4.db and logins.json live alongside it.
- Browser
- Firefox
- Content
- Combined browsing history and bookmarks
- Timestamp format
- PRTime, microseconds since 1 January 1970
- Related files
- cookies.sqlite, formhistory.sqlite, key4.db, logins.json
Common questions
Why must PRTime timestamps be converted carefully during examination?+
PRTime records microseconds rather than the seconds or milliseconds used by many other timestamp formats, so a naive conversion using the wrong unit will place events years off from their true time and skew a browsing timeline.
How does places.sqlite differ from a browser cache in forensic value?+
It records deliberate navigation and bookmark activity with visit counts and timestamps, while the cache stores fetched page resources for performance, so places.sqlite is generally the stronger source for reconstructing what a user actually visited and when.
Related terms
- Hindsight
- An open-source Chromium artefact parser maintained against NIST CFTT-friendly test data. Parses History, Cookies, Local Storage, Downloads, Login Data metadata and Cache...
- Login Data
- Chromium SQLite database of saved credentials. Passwords are stored encrypted; on Windows the OS master key sits under DPAPI scoped to the...
- Section 63 BSA
- Bharatiya Sakshya Adhiniyam 2023 provision that requires a statutory certificate for admissibility of a copy of an electronic record. Applies to browser-extracted...
- Session Restore
- The browser feature that reopens tabs after a restart. Chrome writes Current Tabs / Current Session / Last Tabs / Last Session...
- User Data Directory
- The Chromium profile root that holds History, Cookies, Login Data, Web Data, Cache, Local Storage and Sessions. The Default profile is the...