> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/browser-usage/extensions.md).

# Extensions

Browser extensions, also known as plugins or add-ons, enhance the functionality of web browsers by adding new features or modifying existing ones. They can range from utility tools, ad blockers, and security plugins to customization themes. From a forensic perspective, analyzing extensions installed on a browser can reveal user preferences, potential sources of malware, and even evidence of specific user actions. Here's a closer look at how extensions are managed in popular browsers like Firefox, Google Chrome, and Microsoft Edge.

## Firefox Extensions

* **Firefox 4-25**:
  * Extensions were managed in SQLite databases: `extensions.sqlite` and `addons.sqlite`.
* **Firefox 26+**:
  * The management of extensions transitioned to JSON files: `addons.json` and `extensions.json`.
  * **Location**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\`
  * The JSON format provides detailed information about each installed extension, including the name, installation source, installation time, last update, and plugin status.

## Google Chrome and Microsoft Edge Extensions

* **Location**:
  * Chrome: `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Extensions\<GUID>\<version>`
  * Edge: `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Extensions\<GUID>\<version>`
* Extensions are stored in folders named after their unique GUID, with subfolders for each version.
* The creation time of the folder can hint at the installation time, but this may be influenced by syncing extensions across devices.
* The `manifest.json` file within each extension's folder contains essential details about the extension, including its name, URL, permissions, and version.

## Analyzing Browser Extensions

1. **Identify Installed Extensions**: Navigate to the extensions directory for the browser and profile in question to list all installed extensions, [or use this PowerShell Script](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/powershell-scripts/browser-history-finder).&#x20;
2. **Review Extension Metadata**: Examine the `manifest.json` (Chrome/Edge) or `addons.json`/`extensions.json` (Firefox) files to gather information on the extensions, including their purpose, permissions, and version details.
3. **Installation and Update Timestamps**: Use file system metadata (creation and modification times) to determine when extensions were installed or updated. This can provide insights into user behavior or potential points of compromise.
4. **Cross-Device Syncing Considerations**: Be mindful that timestamps might reflect syncing actions rather than direct user installations, especially in environments where users log into their browser accounts on multiple devices.
5. **Investigate Extension Preferences**: For more in-depth analysis, review the preferences files where browsers may store additional data related to extension settings and states.

## Forensic Implications

* **User Behavior and Interests**: The types of installed extensions can indicate user interests, such as productivity, privacy, or entertainment.
* **Security Analysis**: Malicious or compromised extensions can be vectors for malware, phishing, or data exfiltration. Identifying such extensions is crucial in cybersecurity investigations.
* **Evidence of Actions**: Some extensions might keep logs or data related to their functionality, which can serve as evidence of specific online actions or behaviors.