> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/browser-usage/db-browser-queries/firefox.md).

# Firefox

## **Query for File Downloads**

Firefox stores download history in the `moz_annos` and `moz_places` tables. You can extract information about downloaded files with the following query:

```sql
SELECT p.url AS 'Download URL', 
       datetime(a.dateAdded/1000000,'unixepoch') AS 'Download Date', 
       a.content AS 'Downloaded File'
FROM moz_annos a
JOIN moz_places p ON a.place_id = p.id
WHERE a.anno_attribute_id = 
      (SELECT id FROM moz_anno_attributes WHERE name = 'downloads/destinationFileURI')
ORDER BY a.dateAdded DESC;
```

This query joins the annotations (where download information is stored) with the places table (which stores URLs) to find out what was downloaded, from where, and when.

## **Query for Visiting a Specific Webpage**

To find instances of visiting a specific webpage, you can use:

```sql
SELECT url, title, 
       datetime(last_visit_date/1000000,'unixepoch') AS 'Last Visit Date'
FROM moz_places
WHERE url LIKE '%example.com%'
ORDER BY last_visit_date DESC;
```

Replace **`example.com`** with the domain or specific webpage you're interested in. This query searches the `moz_places` table for URLs that match the pattern and orders the results by the most recent visit.