Session Restore
Definition
The browser feature that reopens tabs after a restart. Chrome writes Current Tabs / Current Session / Last Tabs / Last Session in the Sessions folder; Firefox writes sessionstore.jsonlz4 compressed with mozlz4.
- Purpose
- Reopens browser tabs after restart
- Chrome artefacts
- Current Tabs, Current Session, Last Tabs, Last Session
- Firefox artefact
- sessionstore.jsonlz4
- Firefox compression
- mozlz4
Common questions
Why does Chrome keep both Current and Last session files?+
The Current files track the active session as it changes, while the Last files preserve the state from before the most recent restart, giving an examiner two reference points for tab activity across separate browser sessions.
Can session restore files reveal browsing activity the user tried to close?+
Yes, they can retain open tab URLs and titles from a session that ended normally or crashed, which is useful when history has been cleared but the session snapshot was not.
Related terms
- Hindsight
- An open-source Chromium artefact parser maintained against NIST CFTT-friendly test data. Parses History, Cookies, Local Storage, Downloads, Login Data metadata and Cache...
- Login Data
- Chromium SQLite database of saved credentials. Passwords are stored encrypted; on Windows the OS master key sits under DPAPI scoped to the...
- Places.sqlite
- Firefox's combined history and bookmarks store. Visit timestamps are PRTime (microseconds since 1 January 1970). cookies.sqlite, formhistory.sqlite, key4.db and logins.json live alongside...
- Section 63 BSA
- Bharatiya Sakshya Adhiniyam 2023 provision that requires a statutory certificate for admissibility of a copy of an electronic record. Applies to browser-extracted...
- User Data Directory
- The Chromium profile root that holds History, Cookies, Login Data, Web Data, Cache, Local Storage and Sessions. The Default profile is the...