If a user spends his time on internet, it means for that period of time, he is continuously using a web browser. These browsers have provided a richer web experience and are designed in such a way that whatever a user does on net-opening a website, submitting information, login details etc. takes place within the browser only. This is the reason, many unhoped-for cases are resolved through the artifacts collected from web browsers.
One of the widely used web browsers across the world is Mozilla Firefox. It is an open source platform which is used on Windows, Linux, and OS X. Every activity performed within the web browser is recorded in a database that is stored locally. Mozilla Firefox heavily utilizes SQLite DB and stores most of the browser history: cache, visited websites (along with dates), cookies, downloads etc. into it. SQLite database is a single disk file that either gets saved with .db or .sqlite file extension.
Amongst the various databases recording Firefox activities, the places.sqlite file have the maximum number of artifacts stored in it. This database is a bit complex and has multi-table schema. However, there are certain tables in the SQLite DB that can help to extract the best and helpful information for the case. The URLs that have been visited and at what point of time are two primary concerns of the forensics experts.
This table contains list of all the URLS that have been visited by the accused. Corresponding to every URL, a unique ID is created and this ID corresponds to the places_ID in the moz_historyvsists table.
The place_id here corresponds to the ID filed in the moz_places table.
Plus, the date when the website was visited is saved in PRTime which is a 64-bit integer counting number of microseconds. This is known as Unix Time and can be converted into human readable time (through various free converters).
Bookmarks is one of finest source to find out the interest of the accused. The URLs that are bookmarked can be checked out in this table and the URL can be known through the ID that corresponds to the moz_places table.
All this information stored in SQLite database can be checked out through free Mozilla Firefox History Viewer program. The software enables analyzing the Firefox history saved in places.sqlite database on any Windows platform. More than that, related browser info like cookies, downloads etc. saved into SQLite can be viewed within the software interface.