Session Restore

Session Restore functionality, integral to modern web browsers, significantly enhances user experience by saving the state of all open tabs and windows. In the event of a crash, update, or deliberate closure, this feature allows users to resume their browsing session seamlessly. From a forensic perspective, the data stored by session restore mechanisms can provide a wealth of information about a user's browsing habits, including visited websites, session times, and more.

Firefox Session Restore

Location in Older Versions

• Windows 7 and Later: %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\sessionstore.js

Location in Newer Versions

• Windows 7 and Later:

  • Main File: %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\sessionstore.jsonlz4

  • Backups: %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\sessionstore-backups\

Firefox has transitioned from using the .js extension for session store files to a compressed format .jsonlz4, enhancing storage efficiency and security. These files contain data about open tabs, window configurations, URLs, and, in some cases, form data and page states.

Chrome Session Restore

Location in Older Versions

• %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\

Location in Newer Versions

• %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Sessions

Chrome stores session information in the Sessions directory for newer versions. This includes snapshots of open tabs and windows, facilitating a quick recovery of the browsing session.

Microsoft Edge Session Restore

Location in Older Versions

• %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\

Location in Newer Versions

• %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Sessions

Similar to Chrome, Edge (being Chromium-based) stores session data in the Sessions directory for newer versions, allowing users to restore their previous sessions.

Forensic Analysis of Session Restore Data

Analyzing session restore files can unveil:

• Historical Websites: Lists of URLs opened in each tab, providing a timeline of user activity.

• Referring Websites: Information about how the user navigated to each site, which can be used to trace a user's browsing path.

• Session Timings: Data on when sessions started and ended, offering insights into browsing habits.

• Page Content: HTML, JavaScript, XML, and form data might be stored, revealing what information the user viewed or submitted.

• Browser State: Additional details like transition types, browser window sizes, and whether tabs were pinned, offering context on user preferences and behaviors.

Tools and Techniques for Analysis

1. Accessing Files: Navigate to the session restore directories based on the browser and OS version.

2. Decompression and Decoding: For Firefox's .jsonlz4 files, use specialized tools or scripts to decompress and decode the contents.

3. Analysis Software: Utilize digital forensics tools capable of parsing browser artifacts to analyze session data. Custom scripts may also be written to extract specific information.

4. Manual Inspection: In some cases, manually inspecting the session restore files in a text editor can provide immediate insights, though this is less efficient for larger data sets.