← All artifacts

Firefox Browser

Mozilla Firefox browser artifacts including history, bookmarks, cookies, saved logins, form data, and session storage.

Status
available
CLI plugin
browser.firefox
Categories
browser, user

Overview

Firefox browser artifacts provide detailed web activity records. Firefox's unique profile system and JSONLZ4 session format require specialized parsing, which macfor handles automatically.

Analysis Tips

  • Profile discovery: Parse profiles.ini and installs.ini for all profiles
  • Places database: Contains both history (moz_places, moz_historyvisits) and bookmarks
  • Session files: JSONLZ4 compressed session data includes full tab state
  • Form history: May contain sensitive search queries and form inputs
  • Visit types: Firefox uses its own visit type enumeration

PRTime Timestamps

Firefox uses PRTime (microseconds since 1970-01-01 00:00:00 UTC):

PRTime = Unix timestamp * 1000000

Firefox Variants

macfor supports multiple Firefox variants:

VariantLocation
Firefox~/Library/Application Support/Firefox/
Firefox Developer Edition~/Library/Application Support/Firefox Developer Edition/
Firefox Nightly~/Library/Application Support/Firefox Nightly/

Related Artifacts

References

Data sources

places.sqliteSQLite

~/Library/Application Support/Firefox/Profiles/*/

Browsing history, bookmarks, and downloads

cookies.sqliteSQLite

~/Library/Application Support/Firefox/Profiles/*/

Cookie storage

logins.jsonJSON

~/Library/Application Support/Firefox/Profiles/*/

Encrypted saved credentials

formhistory.sqliteSQLite

~/Library/Application Support/Firefox/Profiles/*/

Form autofill data

recovery.jsonlz4JSONLZ4

~/Library/Application Support/Firefox/Profiles/*/sessionstore-backups/

Session recovery data