> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/browser-usage/db-browser-queries/chrome.md).

# Chrome

## **Query for File Downloads**

Chrome stores file download information in the `downloads` and `downloads_url_chains` tables. You can query this information as follows:

```sql
SELECT d.target_path AS 'Downloaded File', 
       d.referrer AS 'Download Source', 
       datetime(d.start_time/1000000-11644473600, 'unixepoch', 'localtime') AS 'Download Start Time', 
       datetime(d.end_time/1000000-11644473600, 'unixepoch', 'localtime') AS 'Download End Time'
FROM downloads d
JOIN downloads_url_chains duc ON d.id = duc.id
WHERE duc.url LIKE '%'
ORDER BY d.start_time DESC;
```

This query retrieves the paths of downloaded files, their download sources, and the start and end times of downloads.

## **Query for Visiting a Specific Webpage**

To find records of visiting a specific webpage in Chrome, use the `urls` table:

```sql
SELECT url, title, 
       datetime(last_visit_time/1000000-11644473600, 'unixepoch', 'localtime') AS 'Last Visit Time'
FROM urls
WHERE url LIKE '%example.com%'
ORDER BY last_visit_time DESC;
```

Again, replace `example.com` with the domain or specific page you're investigating. This will return URLs matching the search pattern along with the titles and last visit times, sorted by the most recent visit.