> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/browser-usage/auto-complete-data.md).

# Auto-Complete Data

AutoComplete data in web browsers provides a rich source of information for digital forensics and incident response professionals. This data, generated by users as they fill out forms and search fields on the web, is stored locally by browsers to enhance the user experience by predicting and filling in information in similar forms in the future. Here's an overview of how AutoComplete data is stored across different browsers and its forensic implications.

## **Mozilla Firefox**

### **Location of AutoComplete Data**:

* **Form History**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\formhistory.sqlite`
* **Places Database**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\places.sqlite`

The `formhistory.sqlite` database stores information that users have entered into web forms, while `places.sqlite` contains records of URLs, including those typed into the address bar, enhancing the browser's ability to autocomplete URLs based on partial user inputs.

## **Google Chrome and Microsoft Edge**

### **History**:

* Chrome: `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\History`
* Edge: `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\History`

These `History` files contain URLs that have been visited, search queries, and may also include titles of visited web pages, facilitating a predictive typing feature for URLs and search queries.

### **Web Data** (Chrome and Edge):

* `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Web Data`
* `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Web Data`

The `Web Data` file is critical for storing AutoComplete information related to web forms, including names, addresses, search terms, and other entries made by the user.

* **Shortcuts and Network Action Predictor**:
  * These files store information related to frequently visited websites and are used to predict user actions based on their browsing habits.
* **Login Data**:
  * Chrome: `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Login Data`
  * Edge: `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Login Data`

The `Login Data` files are particularly sensitive, as they contain information related to websites where the user has entered a username and password, potentially including encrypted passwords.

## **Forensic Implications**

The forensic analysis of AutoComplete data can reveal:

* User behavior and interaction with specific websites.
* Potential credentials and sensitive personal information.
* Patterns that may help in understanding a user's habits or intentions.

Analyzing these files requires specialized tools and knowledge of database structures to interpret the data correctly. It's crucial to handle this data with care due to its potential sensitivity and the ethical and legal considerations involved in accessing personal information. A tutorial is coming soon!