> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/browser-usage/history-and-downloads/viewing-history-files-db-browser.md).

# Viewing History Files - DB Browser

Extracting and viewing browser history from SQLite databases can provide crucial insights during a forensic investigation. This step-by-step guide will focus on using DB Browser for SQLite, a tool designed to view and edit SQLite databases, which is commonly used for analyzing browser history stored in files like `places.sqlite` (Firefox) and `History` (Chrome, Edge).

#### Step 1: Install DB Browser for SQLite

1. **Download**: Go to the official DB Browser for SQLite website (<https://sqlitebrowser.org/>) and download the version compatible with your operating system.
2. **Install**: Run the installer and follow the on-screen instructions to install DB Browser for SQLite on your computer.

#### Step 2: Locate the Browser History File

* **Use** [**this script**](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/powershell-scripts/browser-history-finder) **to find all Browser History files (Chrome, Firefox & Edge) on a system.**&#x20;
* **Firefox**: Find the `places.sqlite` file in the user's profile directory. Example path for Windows 10:

  ```powershell
  C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\<random text>.default-release\places.sqlite
  ```
* **Chrome/Edge**: Locate the `History` file in the user's profile directory. Example path for Chrome on Windows 10:

  ```powershell
  C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\History
  ```
* **Note**: Replace `USER` with the actual username, and `<random text>` with the specific folder name on your system.

#### Step 3: Make a Copy of the Database File

* **Important**: It’s crucial to work on a copy of the database file to preserve the integrity of the original evidence.
* Copy the `places.sqlite` or `History` file to another location where you can safely analyze it.

#### Step 4: Open the Database in DB Browser for SQLite

1. **Launch DB Browser for SQLite**: Open the application installed in Step 1.
2. **Open Database**: Click on “Open Database” at the top and navigate to the copy of your database file (`places.sqlite` or `History`). Select the file and click “Open”.

#### Step 5: Explore the Database Structure

* **View Tables**: Once the database is open, switch to the “Database Structure” tab to see all the tables within the database. For browser history, look for tables like:
  * Firefox: `moz_places` for website visits.
  * Chrome/Edge: `urls` for website visits.

#### Step 6: View and Query History Data

1. **Browse Data**: Click on the “Browse Data” tab and select the relevant table from the drop-down menu to view its contents.
2. **Custom Queries**: For more detailed analysis, you can run custom SQL queries by switching to the “Execute SQL” tab. Example query for Firefox:

   ```sql
   SELECT datetime(visit_date/1000000,'unixepoch') as visit_date, url 
   FROM moz_places, moz_historyvisits 
   WHERE moz_places.id = moz_historyvisits.place_id 
   ORDER BY visit_date DESC;
   ```

   This query joins the visit and URL information, converting the visit date to a readable format and ordering the results by the most recent visits.

**For more advanced queries, visit the**[ **DB Browser Queries** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/db-browser-queries)**section.**&#x20;

#### Step 7: Analyze the Results

* Review the displayed data to analyze the user's browser history. Pay attention to visit dates, URLs, and, depending on the query, the frequency of visits or titles of the pages.

#### Step 8: Exporting Data

* If needed, you can export the query results or table data by right-clicking on the results and selecting “Export” to choose your preferred format, such as CSV, for further analysis or reporting.

#### Step 9: Documentation

* Document your findings and the steps taken during your analysis, including any specific queries used, for reporting and potential legal proceedings.