The browser is the window through which much of our digital life passes: searches, webmail, social media, shopping, online documents. That makes it one of the richest archives on a computer or phone. A browser analysis can show not only which sites were visited, but also what was searched for, what was downloaded and which accounts were in use.
Where the browser stores data
Modern browsers save information in a folder within the user profile, in the form of small databases and support files. Chrome, Edge and other Chromium-based browsers use very similar structures; Firefox has its own; Safari another again. Each browser profile has its own folder, so several separate histories can exist on the same computer.
The main artifacts
History
It records the addresses visited, the page title, the number of visits and the times. Many browsers also distinguish how the page was reached: by typing the address, clicking a link or using a bookmark. This detail helps determine whether a visit was intentional or accidental.
Searches
Words typed into search engines appear in the addresses of results pages and, in some browsers, in tables dedicated to search terms. Searches are often among the most revealing elements about the intentions of whoever was using the computer.
Downloads
The browser keeps track of downloaded files: name, source address, destination folder, size, date and time, outcome. The download record often remains even after the file has been deleted from the drive.
Cache
To load pages faster, the browser keeps copies of images, scripts and other elements. The cache may contain fragments of visited pages, including social profile images or document previews, even when the history has been cleared.
Cookies and local storage
Cookies and other site storage mechanisms show which services were used and often whether the user was signed in. Creation and last-use dates help place the use of a service in time.
Forms and credentials
Data entered in forms, such as names, addresses and phone numbers, may be stored for autofill. Saved passwords are encrypted, and analysing them requires particular care and authorisation; often it is enough to know which sites have saved credentials, without reading them.
Private browsing
Private mode does not save history, cookies and form data at the end of the session. It does not make you invisible, though: the provider, the company network and the sites visited still see the traffic. On the device, indirect traces may also remain, for example:
- files downloaded during the session, which stay in the downloads folder;
- entries in the system DNS cache, until it is flushed or the computer restarted;
- data in memory, if the system is acquired while the browser is still open;
- operating system records of the application's use.
Habitual use of private browsing is information in itself, but it should not be overrated: many people use it for simple privacy reasons.
Synchronisation across devices
If the user signed in to the browser with an account, history, bookmarks and passwords may be synchronised between computer, phone and tablet. This has two consequences. On one hand, a recorded visit may have happened on another device, and you need to check which. On the other, history deleted on one device may still be present on another or in the account.
Clearing the history
When history is cleared, the data does not always disappear immediately from the browser's databases: freed pages may hold recoverable fragments until they are reused. Moreover, cache, cookies, downloads and system logs are often managed separately. A selective deletion, removing only some entries, can leave clear traces of its own existence, such as a gap in the sequence of identifiers.
How to proceed
- Acquire the browser profile with the computer off or from a forensic copy, without opening the browser.
- Identify all profiles and all installed browsers.
- Analyse history, downloads, cache and cookies with tools that respect the original timestamps.
- Convert times to the reference time zone: browsers use different time formats.
- Cross-check the results with other system artifacts and with email.
In short
- The browser keeps history, searches, downloads, cache, cookies and form data.
- Private mode reduces local traces but does not remove them all.
- Synchronisation can bring in data from other devices and preserve what was deleted.
- Clearing the history does not always remove every fragment.
- Acquire the profile without opening the browser and convert times correctly.