> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/file-download/web-browsing.md).

# Web Browsing

Web browsers are the gateways through which users access and download content from the Internet. Each browser has its own set of conventions for managing file downloads, including specified directories for saving files and temporary storage locations for files in transit. These details can be critical in forensic contexts, offering insights into user actions and the provenance of files.

## Popular Web Browsers and Their Download Mechanisms:

### Google Chrome

* **Process Name**: chrome.exe
* **Default File Path for Downloads**:
  * `%USERPROFILE%\Downloads` on Windows, `~/Downloads` on macOS.
* **Temporary Folder**:
  * `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Cache` on Windows, `~/Library/Caches/Google/Chrome/Default/Cache` on macOS for cached content.

### Mozilla Firefox

* **Process Name**: firefox.exe
* **Default File Path for Downloads**:
  * `%USERPROFILE%\Downloads` on Windows, `~/Downloads` on macOS.
* **Temporary Folder**:
  * `%USERPROFILE%\AppData\Local\Mozilla\Firefox\Profiles\<profile.folder>\cache2` on Windows, `~/Library/Caches/Firefox/Profiles/<profile.folder>/cache2` on macOS for cached downloads.

### Microsoft Edge

* **Process Name**: msedge.exe
* **Default File Path for Downloads**:
  * `%USERPROFILE%\Downloads` on Windows.
* **Temporary Folder**:
  * `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Cache` on Windows for temporary files and cached content.

### Safari

* **Process Name**: Safari.exe (on Windows, though primarily used on macOS)
* **Default File Path for Downloads**:
  * `~/Downloads` on macOS.
* **Temporary Folder**:
  * `~/Library/Caches/com.apple.Safari/Cache.db` on macOS for caching web content.

### Opera

* **Process Name**: opera.exe
* **Default File Path for Downloads**:
  * `%USERPROFILE%\Downloads` on Windows, `~/Downloads` on macOS.
* **Temporary Folder**:
  * `%USERPROFILE%\AppData\Local\Opera Software\Opera Stable\Cache` on Windows, `~/Library/Caches/Opera Software/Opera Stable/Cache` on macOS for cached files.

## Forensic Analysis Considerations:

* **Temporary Folders**: These locations are vital for uncovering files that may not have been permanently saved by the user but were part of the browsing activity.
* **Download Histories**: Apart from physical file locations, examining the browser's download history can provide a chronological account of user downloads.
* **Cache Analysis**: Cached content can reveal accessed web pages, videos, images, and partially downloaded files, offering additional clues about user behavior and interactions.

## Practical Implications in Digital Forensics:

The investigation of default download locations and temporary folders across browsers is crucial for identifying how, when, and what type of content was downloaded or accessed. This analysis aids in constructing user activity timelines, identifying evidence of illicit activities, and correlating downloaded content with potential security incidents.