Browser History Finder

$excludeUsers = @("Public", "LocalAdmin")

$chromePath = "\AppData\Local\Google\Chrome\User Data"
$edgePath = "\AppData\Local\Microsoft\Edge\User Data"
$firefoxPath = "\AppData\Roaming\Mozilla\Firefox\Profiles"

$results = @()

Get-ChildItem C:\Users\* -Directory | Where-Object { $excludeUsers -notcontains $_.Name } | ForEach-Object {
    $user = $_.Name

    # Chrome
    try {
        $path = "C:\Users\$user$chromePath"
        if (Test-Path $path) {
            Get-ChildItem -Path $path -Directory | ForEach-Object {
                $profilePath = $_.FullName + "\history"
                if (Test-Path $profilePath) {
                    $modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime
                    $results += New-Object PSObject -Property @{
                        User = $user
                        Browser = "Google Chrome"
                        Profile = $_.Name
                        ModifiedTime = $modificationTime
                        FilePath = $profilePath
                    }
                }
            }
        }
    } catch {
        Write-Output ("An error occurred while checking Google Chrome history for " + $user + ": " + $_.Exception.Message)
    }

    # Edge
    try {
        $path = "C:\Users\$user$edgePath"
        if (Test-Path $path) {
            Get-ChildItem -Path $path -Directory | ForEach-Object {
                $profilePath = $_.FullName + "\history"
                if (Test-Path $profilePath) {
                    $modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime
                    $results += New-Object PSObject -Property @{
                        User = $user
                        Browser = "Microsoft Edge"
                        Profile = $_.Name
                        ModifiedTime = $modificationTime
                        FilePath = $profilePath
                    }
                }
            }
        }
    } catch {
        Write-Output ("An error occurred while checking Microsoft Edge history for " + $user + ": " + $_.Exception.Message)
    }

    # Firefox
    try {
        $path = "C:\Users\$user$firefoxPath"
        if (Test-Path $path) {
            Get-ChildItem -Path $path -Filter "*.default" -Directory | ForEach-Object {
                $profilePath = $_.FullName + "\places.sqlite"
                if (Test-Path $profilePath) {
                    $modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime
                    $results += New-Object PSObject -Property @{
                        User = $user
                        Browser = "Firefox"
                        Profile = $_.Name
                        ModifiedTime = $modificationTime
                        FilePath = $profilePath
                    }
                }
            }
        }
    } catch {
        Write-Output ("An error occurred while checking Firefox history for " + $user + ": " + $_.Exception.Message)
    }
}

$results | Sort-Object ModifiedTime -Descending | Format-Table -AutoSize | Out-String

Last updated

Was this helpful?