Browser Search Terms

Browser search terms, particularly those related to physical locations, offer a rich dataset for forensic analysts and security professionals. By examining the history of websites visited, including search engine queries, an analyst can gain insights into the user's interests, intentions, and physical movements. This information is stored locally for each user account, allowing for a detailed reconstruction of online activities.

Importance of Browser Search Terms in Forensic Analysis

• Behavioral Analysis: Understanding the context and content of search terms can provide clues about a user's behavior, interests, or plans, including searches related to specific locations.

• Timeline Reconstruction: By analyzing the date and time stamps associated with specific search terms or visited websites, an investigator can reconstruct a timeline of a user's activities.

• Locational Insights: Searches that include addresses, place names, or directions can directly indicate places of interest to the user, potentially correlating with physical movements or intentions to visit those locations.

Location and Extraction of Browser History

Internet Explorer

• Windows XP:

  • %userprofile%\Local Settings\History\History.IE5

• Windows 7–10:

  • %userprofile%\AppData\Local\Microsoft\Windows\History\History.IE5

  • %userprofile%\AppData\Local\Microsoft\Windows\History\Low\History.IE5

For Internet Explorer, history is stored in index.dat files within these directories. Specialized tools are required to parse these files due to their proprietary format.

Firefox

• Windows XP:

  • %userprofile%\Application Data\Mozilla\Firefox\Profiles\<random text>.default\places.sqlite

• Windows 7–10:

  • %userprofile%\AppData\Roaming\Mozilla\Firefox\Profiles\<random text>.default\places.sqlite

Firefox stores history, bookmarks, and downloads in the places.sqlite SQLite database. This file can be queried directly with SQL commands using SQLite tools to extract detailed history and search terms.

Chrome

• All Versions:

  • %userprofile%\AppData\Local\Google\Chrome\User Data\Default\History

Chrome's history is also stored in a SQLite database named History. It contains URLs, visit times, titles, and, most importantly for this context, search terms extracted from the URL itself for searches performed.

Analyzing Search Terms for Physical Location

1. Querying Databases: For browsers that use SQLite databases (Firefox and Chrome), use SQL queries to extract search terms, focusing on URLs that contain known search engine domains (e.g., google.com, bing.com) and parsing the query parameters (e.g., q= for Google searches).

   SELECT url, title, visit_count, last_visit_time FROM urls WHERE url LIKE '%q=%';

2. Index.dat Viewer for IE: Use a specialized index.dat viewer tool for Internet Explorer to extract visited URLs and search terms. Look for patterns or specific keywords that suggest locational searches.

3. Manual Inspection and Scripts: Manually inspecting the history through browser interfaces or writing scripts to automate the extraction and parsing of search terms can yield comprehensive insights, especially when looking for specific locational data.

Forensic Considerations

• Privacy and Sensitivity: Be mindful of privacy considerations when accessing and analyzing browser history, especially when dealing with personal or sensitive locational information.

• Data Integrity: Ensure that forensic copies of the databases or history files are used for analysis to maintain the integrity of the evidence.

• Correlation with Other Artifacts: Correlate browser search terms with other digital artifacts (e.g., GPS data, photographs with geotags, calendar entries) to build a more complete picture of the user's activities and locations.