> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/browser-usage/session-restore.md).

# Session Restore

Session Restore functionality, integral to modern web browsers, significantly enhances user experience by saving the state of all open tabs and windows. In the event of a crash, update, or deliberate closure, this feature allows users to resume their browsing session seamlessly. From a forensic perspective, the data stored by session restore mechanisms can provide a wealth of information about a user's browsing habits, including visited websites, session times, and more.

## Firefox Session Restore

### **Location in Older Versions**

* **Windows 7 and Later**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\sessionstore.js`

### **Location in Newer Versions**

* **Windows 7 and Later**:
  * Main File: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\sessionstore.jsonlz4`
  * Backups: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\sessionstore-backups\`

Firefox has transitioned from using the `.js` extension for session store files to a compressed format `.jsonlz4`, enhancing storage efficiency and security. These files contain data about open tabs, window configurations, URLs, and, in some cases, form data and page states.

## Chrome Session Restore

### **Location in Older Versions**

* `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\`

### **Location in Newer Versions**

* `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Sessions`

Chrome stores session information in the `Sessions` directory for newer versions. This includes snapshots of open tabs and windows, facilitating a quick recovery of the browsing session.

## Microsoft Edge Session Restore

### **Location in Older Versions**

* `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\`

### **Location in Newer Versions**

* `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Sessions`

Similar to Chrome, Edge (being Chromium-based) stores session data in the `Sessions` directory for newer versions, allowing users to restore their previous sessions.

## Forensic Analysis of Session Restore Data

Analyzing session restore files can unveil:

* **Historical Websites**: Lists of URLs opened in each tab, providing a timeline of user activity.
* **Referring Websites**: Information about how the user navigated to each site, which can be used to trace a user's browsing path.
* **Session Timings**: Data on when sessions started and ended, offering insights into browsing habits.
* **Page Content**: HTML, JavaScript, XML, and form data might be stored, revealing what information the user viewed or submitted.
* **Browser State**: Additional details like transition types, browser window sizes, and whether tabs were pinned, offering context on user preferences and behaviors.

## Tools and Techniques for Analysis

1. **Accessing Files**: Navigate to the session restore directories based on the browser and OS version.
2. **Decompression and Decoding**: For Firefox's `.jsonlz4` files, use specialized tools or scripts to decompress and decode the contents.
3. **Analysis Software**: Utilize digital forensics tools capable of parsing browser artifacts to analyze session data. Custom scripts may also be written to extract specific information.
4. **Manual Inspection**: In some cases, manually inspecting the session restore files in a text editor can provide immediate insights, though this is less efficient for larger data sets.