MODULE 6: WEB RELATED

 Web Related Artifacts Category

 Browsing Artifacts and Refined Results
 Browsing Artifact Hierarchy
 Google Chrome
o Chrome Bookmarks
o Chrome Cookies
o Google Analytics Cookies
o Chrome Downloads
o Chrome History
o Chrome Cache
o Chrome Typed URLs
o Chrome Autofill
o Chrome Autofill Profiles
o Chrome Logins
o Chrome Top Sites
 Mozilla Firefox
o Firefox Bookmarks
o Firefox Cookies
o Firefox Downloads
o Firefox Web History and Firefox Web Visits
o Firefox Cache
o Firefox Typed URLs
o Firefox Form History
 Microsoft Edge and Internet Explorer
o Edge Chromium Bookmarks and Internet Explorer Favorites
o Edge Chromium Cookies
o Edge Chromium Downloads
o Edge Chromium and IE History
o Edge Chromium Cache
o Edge Chromium Typed URLs
o Edge Chromium Autofill and Autofill Profiles
 Search Data
o Chrome Search Data
o Firefox Search Data
 Webkit Browser Data
o Webkit Browser Web History (Carved)
 Running Exercises
 Review and Student Exercise

LEARNING OBJECTIVES:
1
In this lesson, students will take part in lectures, hands-on exercises, instructor-led exercises, and student
practical exercises to gain an understanding of Web Browser related artifacts and the databases where those
browsers store their artifacts such as history, typed URLs, bookmarks, download activity, and cached files.

GOALS:
At the conclusion of this lesson, students will be able to identify, discuss, and utilize Magnet AXIOM to conduct
examinations of Web related artifacts. The student will also gain an understanding of how to utilize source linking
to gain access to the browser databases and the way AXIOM recovers artifacts from those ESE (Extensible Storage
Engine) and SQLite databases.

EVIDENCE FOR THIS MODULE:

 Item 01-01: Dell Latitude 3520 Windows 11 Laptop

2
WEB RELATED ARTIFACTS CATEGORY
The category Web Related is typically one of the largest categories in AXIOM. This is due to the
extensive amount of time that people spend conducting online activities. Much of the information in
this category is parsed from multiple databases that are maintained by web browsers. AXIOM will
process information from the following for the category Web Related Artifacts:

FIGURE 6-1: WEB RELATED ARTIFACTS – COMPUTER

FIGURE 6-2: WEB RELATED ARTIFACTS – MOBILE

The majority of web browsers store information in an SQLite database (IE and Edge being the
exception). Much of the information in this module will be related to information parsed from these

3
databases. The instructional materials will concentrate on the main web browsers currently in use:
1) Google Chrome, 2) Mozilla Firefox, 3) Microsoft Internet Explorer, and 4) Microsoft Edge.
Although we will discuss each of these browsers and associated artifacts in detail, this case does not
contain every type of artifact for every browser.

BROWSING ARTIFACTS AND REFINED RESULTS

Much of the content of the Refined Results artifact group is compiled from the results of browser
activity. Because of this, the examiner will see some of the artifacts located in Refined Results
also grouped within their respective browser artifact category within the Web Related artifact
group. Tagging an artifact in Refined Results will not tag the same artifact in its respective
browser artifact category within the Web Related artifact group.
For example, a search for ‘trace a phone’ brought back several results:

FIGURE 6-3: MATCHING RESULTS FOR ‘TRACE A PHONE’

These results are included in the artifact categories of Refined Results and Web Related. The
information in Refined Results is compiled from the information in Web Related.

FIGURE 6-4: RESULTS FROM REFINED RESULTS

4
BROWSER ARTIFACT HIERARCHY
Because there are many different types of browser artifacts, it is important to have a workflow
while working through the artifacts. Each artifact displays different information within the
Evidence Pane. If one artifact does not have the data that an examiner is seeking, another
artifact may contain some of the data. Depending on the case, some web related artifacts may
be more important than others.

Some cases may find that they download of a specific program is key while other may be more
focused on what bookmarks are saved. Some investigations may focus more on the websites to
which a user has browsed or what information is in the web cache. In each case, the order of
operations in working through browser artifacts may change. Using the workflow depicted here
will allow you to be more efficient in locating relevant web browsing data.

FIGURE 6-5: SUGGESTED BROWSER WORKFLOW

GOOGLE CHROME
Google Chrome was first released in 2008 exclusively for use on Microsoft Windows. Since that
time, versions have been developed for macOS, iOS, Android, and Linux. Chrome is the most
popular browser in use and currently accounts for approximately 71% of the worldwide
browser market share.

5
CHROME BOOKMARKS (Chrome Shortcuts)

Bookmarks provide a means for the user to mark sites for which frequent and easy access is
desired. Every browser will have a means of creating these; they also provide a useful artifact
from an investigative standpoint. For Chrome, AXIOM parses these and populates the results in
the Artifact Category WEB RELATED > Chrome Shortcuts.
Chrome stores its bookmarks in a plain text file called “Bookmarks” and shortcuts in an SQLite
database, both located at:
 Users\username\AppData\Local\ Google\Chrome\User Data\Default\

AXIOM will show the following columns/fields for Chrome shortcuts:

Attribute Description

Search Term The search term as interpreted by the browser.

URL The URL of the shortcut.
Original Search The original search query entered by the user.
Query
Last Access The last access time of the shortcut.
Date/Time - UTC
(yyyy-mm-dd)
Web Page Title The title of the webpage.
Times Used The number of times that the shortcut has been used.
Transition Type Describes how the browser navigated to this URL. For
example, if a user visits a page by clicking a link on another
page, the transition type is link.
Type The type of shortcut, such as typed URL or bookmark.

6
 FIGURE 6-6: CHROME BOOKMARK

CHROME COOKIES

Cookies are small files deposited onto a local browsing machine from visited websites. They can
store information about the user, browsing activity, and more. Cookies can be used to determine
that a user has visited a specific web site.
Chrome stores its cookies in an SQLite database named “Cookies” located at:
 Users\username\AppData\Local\ Google\Chrome\User Data\Default\.

AXIOM will show the following columns/fields for Chrome cookies:

Attribute Description

Host The domain of the cookie.

Name The name of the cookie.
Value The value of the cookie.
Accessed Date/Time - UTC (yyyy- The date and time when the cookie was last
mm-dd) accessed.
Created Date/Time - UTC (yyyy-mm- The date and time when the cookie was
dd) created.
Expiration Date/Time - UTC (yyyy- The date and time when the cookie expires.
mm-dd)

7
 Attribute Description

Path The path of the cookie value.

The following is an example of a cookie received by Google Chrome from the web site Amazon:

FIGURE 6-7: GOOGLE CHROME COOKIE

GOOGLE ANALYTICS COOKIES

Google Analytics is a service offered by Google to provide a means for websites to track visitor
activity in a detailed manner. These cookies do not have to be related to the Google Chrome
browser. For example, Firefox and IE both maintain Google Analytics cookies.

These detailed cookies are used to determine the action of users more accurately, such as how they
got to a web site, where they came from, how long they were there, what pages they viewed, etc.
This type of information is used in Google’s business model to generate revenue.

AXIOM identifies cookies containing this information and compiles them under the Refined Results
artifact group. AXIOM also carves out Google Analytics cookies from other areas and will show
these carved items within the Web Related artifact group.

There are three types of Google Analytics Cookie information available. They are:

1. FIRST VISIT COOKIES

First Visit Cookies track detailed information regarding visits to a web site. This information
includes a hash value of the domain, a visitor ID, created date/time, visit date/times, and
number of sessions. The fields tracked and parsed by AXIOM are:

8
 Attribute Description

Host The domain of the URL.

Creation DateTime The date and time when the site was first visited.
Most Recent Visit Date/Time The date and time of the most recent session.
2nd Most The date and time of the previous session.
Recent Visit Date/Time
Hits The number of visits.
Artifact The name of the artifact that the URL was discovered
in.
Artifact ID The row ID of the URL in the original artifact table.

FIGURE 6-8: GOOGLE FIRST VISIT COOKIE

2. SESSION COOKIES
Session Cookies track information regarding activity during a browsing session on a website.
These cookies are short-lived and will automatically expire (get deleted) if the visitor is idle for
30 minutes or longer. The fields tracked and parsed by AXIOM are:

Attribute Description

Host The domain of the URL.

Page Views The number of visits to this page from the user.

9
 Attribute Description

Start The start time of the current session.

Current Session Date/Time
Outbound Link Events Left
Artifact The name of the artifact that the URL was discovered
in.
Artifact ID The row ID of the URL in the original artifact table.

FIGURE 6-9: GOOGLE SESSION COOKIE

In this example, the user visited the site for [Link], arriving on
8/27/2020 at 9:06:04 PM and viewing six pages.

3. REFERRAL COOKIES
These cookies indicate how a user navigated to a particular web site. This is
significant information as referrals to web sites generate are used in
advertising and generate a significant amount of revenue.

The following information is tracked with a referral cookie.

Attribute Description

Cookie Source The source URL used to reach the site.

Host The domain of the URL.
Update The last time that the cookie was updated.
Date/Time
Campaign The method of referral.

10
 Attribute Description

1. Direct: The address was typed into the address bar.

2. Organic: The user clicked on a link from a search engine.
3. Referral: The user clicked on a link on a web site other than a search engine.

Access Method Indicates whether the site was accessed organically or was referred.
Keyword The keywords used to arrive at the site.
Artifact The name of the artifact that the URL was discovered in.
Artifact ID The row ID of the URL in the original artifact table.

FIGURE 6-10: GOOGLE REFERRAL DETAILS

In the example above, the user visited the web site [Link]
using the web browser Mozilla Firefox. The Campaign is listed as ‘direct,’
which indicates that the user typed the URL directly into the web browser.

CHROME DOWNLOADS

Most browsers will track information regarding file downloads. AXIOM will show an artifact
category for download activity for the various browsers.
Chrome tracks download activity in the History file located at:
 Users\username\AppData\Local\Google\Chrome\User Data\Default\

AXIOM will show the following columns/fields for Chrome downloads:

11
 Attribute Description

File Name The file name of the download.

Download Source The URL of the file that was downloaded.
Saved To The location where the download was saved to.
State The state of the download.
Opened By User Indicates whether the download is opened by the user via the
web browser.
Start Time Date/Time - The download start time.
UTC (yyyy-mm-dd)
End Time Date/Time - The download end time.
UTC (yyyy-mm-dd)
Bytes Downloaded The bytes that were downloaded.
File Size (Bytes) The file size of the download.

FIGURE 6-11: CHROME DOWNLOAD

CHROME HISTORY

Browsing History is one of the most important artifacts related to browser usage. It helps to
create a picture and pattern of user activity.
Chrome stores its browser history in an SQLite database named “History” located at:

 Users\username\AppData\ Local\Google\Chrome\User Data\Default\

12
 There are multiple database tables which store history information used by AXIOM. AXIOM will list
two artifact categories to reflect this information – Chrome Web History (obtained from the table:
urls) and Chrome Web Visits (obtained from the table: visits). Each of these tables contains similar
information, with some differences.

AXIOM will show the following columns/fields for Chrome Web History:

Attribute Description

URL The URL of the visited page.

Last Visited Date/Time - The date and time when the webpage was last visited.
UTC (yyyy-mm-dd)
Title The title of the webpage that was visited.
Visit Count The number of times that the webpage was visited.
Typed Count The number of times that the website was accessed by the
user typing the URL (as opposed to clicking a link).

AXIOM will show the following columns/fields for Chrome Web Visits:

Attribute Description

URL The URL of the visited webpage.

Title The title of the webpage that was visited.
Date Visited The date and time when the webpage was last visited.
Date/Time - UTC
(yyyy-mm-dd)
Typed Count The number of times that the website was accessed by the user
typing the URL (as opposed to clicking a link).
Transition Type Describes how the browser navigated to this URL. For example,
if a user visits a page by clicking a link on another page, the
transition type is link.
Visit Source The source of the visit.
0. Synchronized from somewhere else
1. User browsed (see note below)
2. Added by an extension
3. Imported from Firefox
4. Imported from Internet Explorer
5. Imported from Safari

13
Note: Because a value of 1 (user browsed) is by far the most common, it is
not stored in the database for efficiency’s sake and must be a given when no
value is present. AXIOM will not list any empty column data on the Details
card; if the Visit Source needs to be verified, the source link for the artifact
can be used to navigate to the History database > visit source table.

Since table:visits and table:urls have some common information, it is common

to see the same web entries in both tables. For example, in this screen shot,
we can see that the user visited [Link]. While the Item column looks to
contain duplicate entries, we can see that the Artifact Type column indicates
that one entry came from Chrome Web Visits while the other came from
Chrome Web History.

FIGURE 6-12: CHROME WEB VISITS AND CHROME WEB HISTORY

CHROME CACHE

Whenever a user visits a web site, information is automatically downloaded from the web site
to the user’s computer and saved in the Browser Cache. This information includes all code and
resources (scripts, pictures, etc.) that were used to render the web page on the user’s
computer. Each web browser maintains a cache file and AXIOM parses all these files.

When clicking on AXIOM Cache-related artifacts, AXIOM will attempt to render the cached file
or web page in the details pane:

FIGURE 6-13: CHROME CACHE RECORDS

Chrome has multiple locations for local caching of files. For each location, there will be a
corresponding index for the files. AXIOM will show in the Details card a source link for both the
index and the actual cached item. Files will be cached in the following locations, and each will
have a corresponding “index” file within it:

 Users\username\AppData\Local\Google\Chrome\UserData\Default\Cache\
 Users\username\AppData\Local\Google\Chrome\UserData\Default\GPUCache\

14
  Users\username\AppData\Local\Google\Chrome\UserData\Default\Media Cache\

Files within these cache folders will have a naming convention of “data_xx and f_0000xx”.

FIGURE 6-14: CHROME CACHE FILE STRUCTURE

AXIOM will show the following columns/fields for Chrome Cache Records:

Attribute Description

URL The URL of the cached item.

Last Visited Date/Time - The date and time when the URL was last visited.
UTC (yyyy-mm-dd)
First Visited Date/Time - The date and time when the URL was first visited.
UTC (yyyy-mm-dd)
Last Sync Date/Time - The date and time when the cache was last synced with the
UTC (yyyy-mm-dd) cloud.
File Type The type of file that was cached.
Content Size (Bytes) The size of the cached file.
Image The cached image if the file type is an image. Otherwise,
this column is empty.
Content The cached file contents if the file type is not an image.
Otherwise, this column is empty.

CHROME TYPED URLs

Typed URLS indicate when a URL has been typed (or copy/pasted) directly into the address bar
of the browser. The user doesn’t necessarily need to type the entire URL for it to be recorded as a
Typed URLs. As long as any portion of the URL is typed, the Typed Count is incremented for the
artifact. Chrome and Firefox both track this information within their browser history database
files. In both cases, a view of the browser history files in the Details Card of the Content Pane
will show the Typed URL status.
Chrome stores its Typed URLs within the History SQLite database located at:

15
 • Users\username\AppData\Local\Google\Chrome\UserData\Default\
AXIOM displays the information in the Details pane for Chrome Web History and Chrome Web
Visits. The entry will show a number reflecting the number of times the URL has been typed.

FIGURE 6-15: CHROME TYPED URLs

CHROME AUTOFILL

Most browsers provide a means to store form information that would commonly be used
to fill out basic information on multiple websites, such as name, phone number, address,
etc.
Chrome stores its form data in an SQLite database named “Web Data” located at:
• Users\username\AppData\ Local\Google\Chrome\User Data\Default\
Information is stored in the table “autofill.” AXIOM will list the artifacts drawn from the Web
Data database in the Chrome Autofill artifact category. AXIOM will show the following
columns/fields for Chrome Autofill:

Attribute Description
Name The name of the autofill value.
Value The saved autofill value for this type of field.
Count The count of this autofill.
Date Created Date/Time - UTC The date and time that the autofill value was created.
(yyyy-mm-dd)
Last Used Date/Time - UTC The date and time that the autofill was last used.
(yyyy-mm-dd)

16
 FIGURE 6-16: CHROME AUTOFILL

In this database, the Date Created refers to the first time that the autofill information was used.
Subsequent uses do not update this date/time. Therefore, if an entry has more than one Count,
we can determine when the first time was that it was autofilled and the total number of times
that it was autofilled, but not when those subsequent uses occurred.

CHROME AUTOFILL PROFILES

Chrome Autofill Profiles contains a profile of all autofill information that Chrome uses to fill
in forms with saved values. Chrome also stores these data in an SQLite database named
“Web Data” located at:
• Users\username\AppData\ Local\Google\Chrome\User Data\Default\
Information is stored in multiple tables within the Web Data database. AXIOM will show the
following columns/fields for Chrome Autofill Profiles:

17
 Attribute Description
Name The name for the autofill profile.
Email The email used in the autofill profile.
Number The phone number used in the autofill profile.
Company Th company name used in the autofill profile.
Address Line 1 The address Line 1 used in the autofill profile.
Address Line 2 The address Line 2 used in the autofill profile.
City The city used in the autofill profile.
State The state used in the autofill profile.
Zipcode The Zipcode used in the autofill profile.
Country The country used in the autofill profile.
Date Modified Date/Time - UTC (yyyy-mm-dd) The date and time that the profile was last modified.

FIGURE 6-17: CHROME AUTOFILL PROFILES

CHROME LOGINS
Chrome Logins contains log in information that is collected when the user logs into a site using
Google Chrome. Among the information collected is the User Name, Password, Created Date/Time,
and URL. While the password is often encrypted, other information in Chrome Logins can
determine the specific sites that the user has been logging into along with the username that has
been used.

AXIOM will show the following columns/fields for Chrome Logins:

Attribute Description
URL The URL of the login page.
Username The username entered.
Password The password entered.
Created Date/Time - UTC (yyyy-mm-dd) The date and time that the data was created.
URL The URL of the web page being accessed with the

18
 Attribute Description
credentials.

FIGURE 6-18: CHROME LOGINS

CHROME TOP SITES

Chrome Top Sites contains a listing of the websites that are most popular to the user. These sites
are displayed as icons on the browser’s home page which allows the user to quickly access the site.
In addition to listing the sites, the sites are also ranked in terms of how frequently the site is visited.

AXIOM will show the following columns/fields for Chrome Top Sites:

Attribute Description
URL The URL of the site.
Title The title of the site.
Last Updated The date and time when the site was last updated.
Date/Time - UTC
(yyyy-mm-dd)
Rank A ranking of the website, in terms of how frequently it was visited. A value of 1
indicates the most frequent and values increment to 8 as frequency decreases. A
value of -1 indicates a site that the user manually added to the list of top sites.
Thumbnail The thumbnail of the site.

FIGURE 6-19: CHROME TOP SITES

MOZILLA FIREFOX
Mozilla Firefox, or simply Firefox, was first released in 2002. At the time, the browser
marketplace was dominated by Microsoft Internet Explorer. Firefox became popular due to its
speed and security. Within the first nine of months of release, Firefox was downloaded

19
approximately 60 million times. As of October 2019, Firefox has approximately 9.5% of the
worldwide browser market share.

FIREFOX BOOKMARKS
Firefox stores bookmarks in an SQLite database named “[Link]”, which also stores other
artifacts like history. The file is located at Users\username\AppData\Roaming\Mozilla\Firefox\
Profiles\[Link]\.
AXIOM pulls information from two tables within the database – moz_places and moz_bookmarks.
The following columns/fields will be shown:

Attribute Description
URL The URL of the website that was bookmarked.
Added Date/Time - UTC (yyyy-MM-dd) The date and time that the bookmark was created.
Last Modified Date/Time - UTC (yyyy-MM-dd) The date and time that the field was last modified.
Title The title of the bookmark.
Bookmark Type The type of bookmark (Bookmark Item or Bookmark Folder).

FIGURE 6-20: FIREFOX BOOKMARKS

FIREFOX COOKIES
Firefox stores cookies in an SQLite database named “[Link]”. The file is located at:
 Users\username\ AppData\Roaming\Mozilla\Firefox\Profiles\[Link]\
AXIOM pulls information from a table within the database, moz_cookies. The following
columns/fields will be shown:

Attribute Description
Host The host domain of the cookie.
Name The name of the cookie.
Value The value of the cookie.
Accessed Date/Time - UTC The date and time that the cookie was last accessed.

20
 Attribute Description
(yyyy-MM-dd)
Created Date/Time - UTC The date and time when the cookie was created.
(yyyy-MM-dd)
Expiration Date/Time - UTC The date and time when the cookie will expire, if it is set to expire.
(yyyy-MM-dd)
Path The path to the cookie.

The following is an example of a cookie received by Firefox from the web site [Link]:

FIGURE 6-21: FIREFOX COOKIE

FIREFOX DOWNLOADS
Firefox tracks downloads in an SQLite database named “[Link]”, which also stores other
artifacts like history. The file is located at:
 Users\username\AppData\Roaming\Mozilla\Firefox\Profiles\[Link]\

AXIOM pulls information from several tables within the database. The following columns/fields will
be shown:

Attribute Description
File Name The name of the file being downloaded.

21
 Attribute Description
Download Source The URL of the file being downloaded.
Start Date/Time - The date and time when the download was started.
UTC (yyyy-MM-dd)
End Date/Time - The date and time when the download was ended.
UTC (yyyy-MM-dd)
Saved To The path to where the file was downloaded to.
Temp Path The path to where the file was saved during downloading.
State The state of the download can be Download In Progress, Download Complete,
Download Stopped, or Download Paused.
Referrer If the webpage used a mirror for downloading, this value is the path to the original
download URL.

FIGURE 6-22: FIREFOX DOWNLOADS

FIREFOX WEB HISTORY AND FIREFOX WEB VISITS

Firefox stores its browser history in an SQLite database named “[Link]” located at:

• Users\username\AppData\Roaming\Mozilla\Firefox\Profiles\[Link]\

There are two database tables which store the history information used by AXIOM. Like Google
Chrome, AXIOM will list two artifact categories to reflect this information – Firefox Web History
and Firefox Web Visits. Web History keeps a record of unique web sites visited. Web Visits
keeps a record of the number of times a user visits a unique web site.

AXIOM will show the following columns/fields for Firefox Web History:

Attribute Description
URL The URL of the webpage.
Last Visited Date/Time - UTC (yyyy-MM-dd) The date and time that the webpage was last visited.
Title The title of the webpage.
Visit Count The number of times that the webpage has been visited.
Typed Indicates whether the user typed the URL (Yes or No).

22
 FIGURE 6-23: FIREFOX WEB HISTORY

AXIOM will show the following columns/fields for Firefox Web Visits:

Attribute Description
URL The URL that was visited.
Title The title of the page that was visited.
Date Visited Date/Time - The date and time that the page was visited.
UTC (yyyy-mm-dd)
Typed Indicates whether the user typed the URL (Yes or No).
Transition Type Identifies how the transition to the page happened.
TRANSITION_LINK: User clicked on a link
TRANSITION_TYPED: User typed the URL into the address bar
TRANSITION_BOOKMARK: User clicked on a bookmark for the website
TRANSITION_EMBED: Content within a web page was load (this would include
imbedded images)
TRANSITION_REDIRECT_PERMANENT: Transition was a permanent redirect
TRANSITION_REDIRECT_TEMPORARY: Transition was a temporary redirect
TRANSITION_DOWNLOAD: A download link was clicked on

FIGURE 6-24: FIREFOX WEB VISITS

23
FIREFOX CACHE
Firefox stores cache files in a folder named “entries”. The folder is located at:
• Users\username\AppData\Roaming\Mozilla\Firefox\Profiles\[Link]\cache2\
entries
The index of the cached files is found in a file called “index”, found in the cache2 folder. AXIOM
will show the following columns/fields:

Attribute Description
URL The URL of the cached entry.
Created Date/Time - UTC (yyyy-mm-dd) The date and time that the cached entry was created.
MIME Type The MIME type of the cached data.
Content Size (Bytes) The content size of the cached data.
Image The image that should one be associated with the cached entry.
Content The content that should any be associated with the cached entry.

FIGURE 6-25: FIREFOX CACHE RECORDS

FIREFOX TYPED URLs

Firefox stores its Typed URLS within the history SQLite database named “[Link]”. The file is
located at:
• Users\ username\AppData\Roaming\Mozilla\Firefox\Profiles\[Link]\

24
AXIOM displays this information under the artifact category Firefox Web History. Information will
indicate a “Yes” or “No” as to whether the URL has been typed into the address bar, as shown in
the following screen shot:

FIGURE 6-26: FIREFOX TYPED URLs

FIREFOX FORM HISTORY

Firefox stores form data in an SQLite database named “[Link]”. The file is located at:
• Users\username\ AppData\Roaming\Mozilla\Firefox\Profiles\[Link]\
The table within the database is named “moz_formhistory”. The following columns/fields will
be shown:

Attribute Description
Field Name The name of the field.
Value The value of the field.
First Used Date/Time - The date and time that the field was first used.
UTC (yyyy-MM-dd)
Last Used Date/Time - The date and time that the field was last used.
UTC (yyyy-MM-dd)
Times Used The number of times that the field has been used.
ID The unique ID of the field. A number which tells whether the entry was the first,
second, etc.., in the table.

25
 FIGURE 6-27: FIREFOX AUTOFILL

MICROSOFT EDGE AND INTERNET EXPLORER

Microsoft Internet Explorer (IE) was initially released in 1995 as part of Windows 95. By 2003,
IE dominated the worldwide browser market share, accounting for approximately 95% of
browser usage. Since the release of Firefox and Chrome, the popularity of IE has declined.
Development on IE has been discontinued (although the browser is still supported by
Microsoft) and was replaced with Microsoft Edge, which was released in 2015. Currently, IE
accounts for approximately 1.7% of the worldwide browser market share and Edge accounts
for approximately 10%.

EDGE CHROMIUM BOOKMARKS AND INTERNET EXPLORER FAVORITES

Edge Chromium stores bookmarks in a .json file located at the following location:
 \Users\username\AppData\Local\Microsoft\Edge\User Data\Default\bookmarks

The following fields are available for Edge Chromium Bookmarks:

Attribute Description
URL The URL of the bookmark.
Added Date/Time - UTC (yyyy-mm-dd) The date and time that the bookmark was added.
Name The name of the bookmark.

26
 Attribute Description
Parent The name of the parent folder of the bookmark.
Type The type of bookmark.

FIGURE 6-28: EDGE CHROMIUM BOOKMARKS

Internet Explorer stores Favorites as .url files at the following location:

 \Users\username\Favorites

The following fields are available Internet Explorer Favorites:

Attribute Description
Favorite Name The name of the favorite as it shows up in Internet Explorer.

URL The URL of the favorite.

Modified Date/Time - UTC (yyyy- The last time that the user modified the favorite.
mm-dd)
User The user to whom the favorite belongs.

Favorites Root Location The local path that is the root storage point for the favorite.

Folder Structure The folder structure under which the favorite will show up
in Internet Explorer.
Icon URL The URL of the icon for the favorite if an icon does exist.

27
 FIGURE 6-29: INTERNET EXPLORER FAVORITES

EDGE CHROMIUM COOKIES

Edge Chromium stores cookies in a .sqlite database named Cookies that is located at the
following location:
 \Users\username\AppData\Local\Microsoft\Windows\Edge\User Data\Default\Network

The fields/columns for Edge Chromium cookies are as follows:

Attribute Description
Host The host that created the cookie.
Name The name of the cookie.
Accessed Date/Time - UTC (yyyy-mm-dd) The date and time the cookie was accessed.
Created Date/Time - UTC (yyyy-mm-dd) The date and time when the cookie was created.
Expiration Date/Time - UTC (yyyy-mm-dd) The date and time when the cookie expires.

FIGURE 6-30: EDGE CHROMIUM COOKIES

EDGE CHROMIUM DOWNLOADS

The Edge Chromium stores download information in a .sqlite database named History located at
the following location:
 \Users\username\AppData\Local\Microsoft\Edge\User Data\Default\History

28
The following fields are tracked in the database:

Attribute Description
Download Source The URL of the file that was downloaded.
File Name The file name of the download.
Start Time Date/Time - UTC (yyyy-mm-dd) The download start time.
End Time Date/Time - UTC (yyyy-mm-dd) The download end time.
Saved To The saved to location.
State The state of the download.
Opened By User Indicates whether the download is opened by the user.
Bytes Downloaded The bytes that were downloaded.
File Size (Bytes) The file size of the download.

FIGURE 6-31: EDGE CHROMIUM DOWNLOADS

EDGE CHROMIUM AND IE HISTORY

Edge Chromium stores its browser history in an SQLite database named History located at:

• Users\username\AppData\Local\Microsoft\Edge\User Data\Default\History

There are two database tables which store the history information used by AXIOM. Like
Chrome and Firefox, AXIOM will list two artifact categories to reflect this information – Edge
Chromium Web History and Edge Chromium Web Visits. Web History keeps a record of unique
web sites visited. Web Visits keeps a record of the number of times a user visits a unique web
site.

AXIOM will show the following columns/fields for Edge Chromium Web History:

Attribute Description
URL The URL of the visited page.
Last Visited The date and time that the webpage was last visited.
Date/Time - UTC
(yyyy-mm-dd)
Title The title of the webpage that was visited.
Visit Count The number of times the webpage was visited. The value for this fragment is
interpreted to show the actual visit count. The source data starts counting at 0 (0
indicates a single visit occurred), whereas the value that is displayed here is the actual
visit count (1 indicates a single visit).
Typed Count This fragment is not populated for iOS.

29
 FIGURE 6-32: EDGE CHROMIUM WEB HISTORY

AXIOM will show the following columns/fields for Edge Chromium Web Visits:

Attribute Description
URL The URL of the visited webpage.
Date Visited Date/Time - The date and time when the webpage was last visited.
UTC (yyyy-mm-dd)
Title The title of the webpage that was visited.
Typed Count The number of times that the website was accessed by the user typing the URL
(as opposed to clicking a link).
Transition Type Describes how the browser navigated to this URL. For example, if a user visits a
page by clicking a link on another page, the transition type is 'link'.
Visit Source The source of the visit.
_rawtime The hidden raw time.

FIGURE 6-33: EDGE CHROMIUM WEB VISITS

Internet Explorer stores browser history in an Extensible Storage Engine (ESE) database named
“[Link].” Also known as Jet Blue, the ESE database is technology from Microsoft and is
at the core of several services, including Microsoft Exchange Server, Active Directory, and Windows
Search. The ESE database is located at:

30
  Users\username\AppData\Local\microsoft\Windows\WebCache\

There are separate tables within the database for daily/Weekly History and Main History. Daily
History maintains the most recent 24 hours of history. Weekly history maintains the most recent
seven days of history. Main History maintains the entire history. AXIOM will show the following
columns/ fields for Internet Explorer 10-11 Daily/Weekly History and Internet Explorer 10-11 Main
History:

Attribute Description

Entry ID The entry ID.

URL The URL that was accessed by the user.
User The local user on the system.
Accessed The most recent visit to the URL.
Date/Time - UTC
(yyyy-mm-dd)
Page Title The title of the webpage.
Access Count The number of times that the website was accessed.
Browser Source The directory of the browser from where the history is extracted
from.

FIGURE 6-34: EDGE MAIN HISTORY

As we saw in Refined Results, when a user navigates to a file using Windows Explorer and then
opens the file by double-clicking on it, this activity is recorded in the ESE database as a Locally
Accessed File with a URL beginning File:///. Therefore, it is common to see these entries in the
artifact categories related to Internet Explorer history.

EDGE CHROMIUM CACHE

Whenever a user visits a web site, information is automatically downloaded from the web site
to the user’s computer and saved in the Browser Cache. This information includes all code and
resources (scripts, pictures, etc.) that were used to render the web page on the user’s
computer. Each web browser maintains a cache file and AXIOM parses all these files.

31
 When clicking on AXIOM Cache-related artifacts, AXIOM will attempt to render the cached file
or web page in the details pane:

FIGURE 6-35: EDGE CHROMIUM CACHE RECORDS

Edge Chromium has multiple locations for local caching of files. For each location, there will be a
corresponding index for the files. AXIOM will show in the Details card a source link for both the
index and the actual cached item. Files will be cached in the following locations, and each will
have a corresponding “index” file within it:

 Users\username\AppData\Local\Microsoft\Edge\User Data\Default\Cache\
 Users\username\AppData\Local\Microsoft\Edge\UserData\Default\GPUCache\
 Users\username\AppData\Local\Microsoft\Edge\UserData\Default\Media Cache\

Files within these cache folders will have a naming convention of “data_xx and f_0000xx”.

FIGURE 6-36: CHROME CACHE FILE STRUCTURE

AXIOM will show the following columns/fields for Edge Chromium Cache Records:

Attribute Description
URL The URL of the cached item.
Last Visited Date/Time - UTC The date and time when the URL was last visited.
(yyyy-mm-dd)
First Visited Date/Time - UTC The date and time when the URL was first visited.

32
 Attribute Description
(yyyy-mm-dd)
Last Sync Date/Time - UTC The date and time when the cache was last synced with the cloud.
(yyyy-mm-dd)
File Type The type of file that was cached.
Content Size (Bytes) The size of the cached file.
Image The cached image if the file type is an image. Otherwise, this column is
empty.
Content The cached file contents if the file type is not an image. Otherwise, this
column is empty.

EDGE CHROMIUM TYPED URLs

Typed URLs indicate when a URL has been typed (or copy/pasted) directly into the address bar
of the browser. The user doesn’t necessarily need to type the entire URL for it to be recorded as a
Typed URLs. As long as any portion of the URL is typed, the Typed Count is incremented for the
artifact. Edge Chromium tracks this information within the browser history database files and
Typed URLs are displayed in the Edge Chromium Web History and Edge Chromium Web Visits
artifact categories.
Edge Chromium stores its Typed URLS within the History SQLite database located at:
• Users\username\AppData\Local\Microsoft\Edge\User Data\Default\
AXIOM displays the information in the Details pane for Edge Chromium Web History and Edge
Chromium Web Visits. The entry will show a number reflecting the number of times the URL has
been typed.

FIGURE 6-37: EDGE CHROMIUM TYPED URLs

EDGE CHROMIUM AUTOFILL AND AUTOFILL PROFILES

Edge Chromium stores its form data in a .sqlite file named Web Data located at the following
location:
 \Users\username\AppData\Local\Microsoft\Edge\User Data\Default
At the time of this writing, the data for Edge Chromium Autofill and Edge Chromium Autofill

33
 Profiles is listed as <Encrypted Data> in Artifact Explorer:

FIGURE 6-38: EDGE CHROMIUM AUTOFILL AND AUTOFILL PROFILES (ARTIFACT

EXPLORER)

Upon viewing the data in File System Explorer, it can be seen that the data is not encrypted and that
the values can be viewed.

FIGURE 6-39: EDGE CHROMIUM AUTOFILL AND AUTOFILL PROFILES (FILE SYSTEM
EXPLORER)

SEARCH DATA
Searches executed on a search engine website or locally within a dedicated search box will often
be of investigative interest. Search engine queries will normally include the search term itself
embedded in the URL. AXIOM Examine will group these search URLs within either Google Search
Queries or Parsed Search Queries under Refined Results. Some browsers will also store these
search queries separately in dedicated structures.

CHROME SEARCH DATA

Searches conducted in Chrome are populated in the artifact category of Chrome Keyword Search
Terms. Some searches in Chrome will be tracked within the same Web Data SQLite database
where form data is stored.
The items generated from searching will populate the Name column with a query header. A
query header comes from the search engine; for many search engines it will simply be a “q=”.
This is determined by the specific search engine being used or the site being searched. In this
example, Twitter, Google, Pinterest, Bing, and Facebook all use “q=”.

34
 FIGURE 6-40: SEARCH URL USING “q=”

In this example, YouTube uses “search_query=”:

FIGURE 6-41: SEARCH URL USING “search_query=”

FIREFOX SEARCH DATA

Firefox stores search terms executed within the built-in search box in the [Link]
database. This is the same database that stores form data. AXIOM populates this information in
WEB RELATED > Firefox FormHistory. Instead of the name of a form field, a search query will
generically use “searchbar- history” to populate the Field Name column. This data can be cross
referenced with browsing history, Parsed Search Queries and Google Searches to possibly
determine the source of a search.

35
 FIGURE 6-42: FIREFOX SEARCHBAR HISTORY SEARCHES

WEBKIT BROWSER DATA

WebKit is an open-source web browser engine that is used to power many web browsers and
applications. It was originally developed by Apple for use in the Safari Browser. Over time, many
other browsers, such as Google Chrome, Firefox, and Brave, have adopted the use of the WebKit
engine.
The WebKit browser artifacts can often help to show other browsers that have been used by the
user on a computer. AXIOM can often carve information that is stored within browsers that mimic
the WebKit engine stored structure. By reviewing information in the source fragments within
AXIOM, users may deduce what browser the data came from.

WEBKIT BROWSER WEB HISTORY (CARVED)

WebKit Browser Web History contains information about the websites that a user visits while using
a browser built with WebKit. Some examples of browsers that use WebKit are Chrome, Opera,
Brave, and 360 Safe Browser. This artifact consolidates the existing Chrome, Safe Browser, and
Opera equivalents in a single artifact. The usage of other browsers is not likely to appear under this
artifact; however, some URLs found by other browsers may also be found by this artifact.

AXIOM will show the following columns/fields for WebKit Browser Web History (Carved) Records:

Attribute Description
URL The URL of the visited webpage.
Title The title of the visited webpage.
Last Visited Date/Time - UTC The date and time that this webpage was last visited.
(yyyy-mm-dd)
Visit Count The number of times that the webpage was visited.
Typed Count The number of times that the website was accessed by the user typing the
URL (as opposed to clicking a link).

36
FIGURE 6-43: WEBKIT BROWSER WEB HISTORY (CARVED)

37