Bookmarks

Bookmarks in web browsers serve as a digital trail of a user's interests and priorities online, marking websites for easy access in the future. These artifacts not only reflect user-chosen content but also include default bookmarks added by the browser. For forensic analysts, bookmarks can provide valuable insights into a subject's online behavior, interests, and activities. Here's an in-depth look at how bookmarks are stored and managed in popular browsers like Firefox, Google Chrome, and Microsoft Edge.

Firefox Bookmarks

Location

• Main Bookmarks Database:

  %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\places.sqlite

• Backup Bookmarks:

  %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\bookmarkbackups\bookmarks-<date>.jsonlz4

Firefox stores bookmarks in the places.sqlite database, which also houses history and other related data. The browser automatically creates backup copies of bookmarks in the bookmarkbackups folder in compressed JSON format (jsonlz4), allowing for recovery and analysis even if the main database is corrupted or deleted.

Chrome and Edge Bookmarks

Location in Chrome

• Main Bookmarks File:

  %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Bookmarks

• Backup Bookmarks File:

  %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Bookmarks.bak

Location in Edge

• Main Bookmarks File:

  %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Bookmarks

• Backup Bookmarks File:

  %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Bookmarks.msbak

Both Chrome and Edge store bookmarks in a JSON format file named Bookmarks, making it relatively straightforward to access and analyze bookmark data. These browsers also create backup copies of bookmarks, ensuring that previous states can be recovered or examined.

Analyzing Bookmark Data

1. Accessing Bookmark Files: Navigate to the appropriate location based on the browser. For Firefox, you may need tools capable of reading SQLite databases or decompressing jsonlz4 files. Chrome and Edge bookmark files can be opened directly with text editors or JSON viewers.

2. Content of Interest: Bookmark data typically includes:

   • The title of the bookmark.

   • The URL of the bookmarked page.

   • The date the bookmark was created.

   • Folder organization for the bookmark, if applicable.

3. Forensic Implications: Analyzing bookmarks can reveal:

   • Websites of interest to the user.

   • Organizational methods (how bookmarks are sorted into folders).

   • Potential evidence of planning or research related to a case.

   • Timestamps that may correlate with other activities or incidents.

4. Considerations: It's important to note that a bookmark's presence doesn't necessarily indicate that the site was visited. Users can bookmark pages based on recommendations or for future reference without actually accessing the content at the time of bookmarking.

Tools for Analysis

• SQLite Browsers: For Firefox's places.sqlite, tools like DB Browser for SQLite can query and export bookmark data.

• JSON Viewers: Chrome and Edge bookmark files can be analyzed using any text editor or a specialized JSON viewer for easier navigation of the structure.