> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/browser-usage/bookmarks.md).

# Bookmarks

Bookmarks in web browsers serve as a digital trail of a user's interests and priorities online, marking websites for easy access in the future. These artifacts not only reflect user-chosen content but also include default bookmarks added by the browser. For forensic analysts, bookmarks can provide valuable insights into a subject's online behavior, interests, and activities. Here's an in-depth look at how bookmarks are stored and managed in popular browsers like Firefox, Google Chrome, and Microsoft Edge.

#### Firefox Bookmarks

**Location**

* **Main Bookmarks Database**:

  ```sql
  %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\places.sqlite
  ```
* **Backup Bookmarks**:

  ```sql
  %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\bookmarkbackups\bookmarks-<date>.jsonlz4
  ```

Firefox stores bookmarks in the `places.sqlite` database, which also houses history and other related data. The browser automatically creates backup copies of bookmarks in the `bookmarkbackups` folder in compressed JSON format (`jsonlz4`), allowing for recovery and analysis even if the main database is corrupted or deleted.

#### Chrome and Edge Bookmarks

**Location in Chrome**

* **Main Bookmarks File**:

  ```sql
  %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Bookmarks
  ```
* **Backup Bookmarks File**:

  ```sql
  %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Bookmarks.bak
  ```

**Location in Edge**

* **Main Bookmarks File**:

  ```sql
  %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Bookmarks
  ```
* **Backup Bookmarks File**:

  ```sql
  %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Bookmarks.msbak
  ```

Both Chrome and Edge store bookmarks in a JSON format file named `Bookmarks`, making it relatively straightforward to access and analyze bookmark data. These browsers also create backup copies of bookmarks, ensuring that previous states can be recovered or examined.

#### Analyzing Bookmark Data

1. **Accessing Bookmark Files**: Navigate to the appropriate location based on the browser. For Firefox, you may need tools capable of reading SQLite databases or decompressing `jsonlz4` files. Chrome and Edge bookmark files can be opened directly with text editors or JSON viewers.
2. **Content of Interest**: Bookmark data typically includes:
   * The title of the bookmark.
   * The URL of the bookmarked page.
   * The date the bookmark was created.
   * Folder organization for the bookmark, if applicable.
3. **Forensic Implications**: Analyzing bookmarks can reveal:
   * Websites of interest to the user.
   * Organizational methods (how bookmarks are sorted into folders).
   * Potential evidence of planning or research related to a case.
   * Timestamps that may correlate with other activities or incidents.
4. **Considerations**: It's important to note that a bookmark's presence doesn't necessarily indicate that the site was visited. Users can bookmark pages based on recommendations or for future reference without actually accessing the content at the time of bookmarking.

#### Tools for Analysis

* **SQLite Browsers**: For Firefox's `places.sqlite`, tools like [DB Browser for SQLite](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/history-and-downloads/viewing-history-files-db-browser) can query and export bookmark data.
* **JSON Viewers**: Chrome and Edge bookmark files can be analyzed using any text editor or a specialized JSON viewer for easier navigation of the structure.