Browser History Finder
$excludeUsers = @("Public", "LocalAdmin")
$chromePath = "\AppData\Local\Google\Chrome\User Data"
$edgePath = "\AppData\Local\Microsoft\Edge\User Data"
$firefoxPath = "\AppData\Roaming\Mozilla\Firefox\Profiles"
$results = @()
Get-ChildItem C:\Users\* -Directory | Where-Object { $excludeUsers -notcontains $_.Name } | ForEach-Object {
$user = $_.Name
# Chrome
try {
$path = "C:\Users\$user$chromePath"
if (Test-Path $path) {
Get-ChildItem -Path $path -Directory | ForEach-Object {
$profilePath = $_.FullName + "\history"
if (Test-Path $profilePath) {
$modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime
$results += New-Object PSObject -Property @{
User = $user
Browser = "Google Chrome"
Profile = $_.Name
ModifiedTime = $modificationTime
FilePath = $profilePath
}
}
}
}
} catch {
Write-Output ("An error occurred while checking Google Chrome history for " + $user + ": " + $_.Exception.Message)
}
# Edge
try {
$path = "C:\Users\$user$edgePath"
if (Test-Path $path) {
Get-ChildItem -Path $path -Directory | ForEach-Object {
$profilePath = $_.FullName + "\history"
if (Test-Path $profilePath) {
$modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime
$results += New-Object PSObject -Property @{
User = $user
Browser = "Microsoft Edge"
Profile = $_.Name
ModifiedTime = $modificationTime
FilePath = $profilePath
}
}
}
}
} catch {
Write-Output ("An error occurred while checking Microsoft Edge history for " + $user + ": " + $_.Exception.Message)
}
# Firefox
try {
$path = "C:\Users\$user$firefoxPath"
if (Test-Path $path) {
Get-ChildItem -Path $path -Filter "*.default" -Directory | ForEach-Object {
$profilePath = $_.FullName + "\places.sqlite"
if (Test-Path $profilePath) {
$modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime
$results += New-Object PSObject -Property @{
User = $user
Browser = "Firefox"
Profile = $_.Name
ModifiedTime = $modificationTime
FilePath = $profilePath
}
}
}
}
} catch {
Write-Output ("An error occurred while checking Firefox history for " + $user + ": " + $_.Exception.Message)
}
}
$results | Sort-Object ModifiedTime -Descending | Format-Table -AutoSize | Out-String
Last updated
Was this helpful?