Mozilla Firefox is fast becoming one of the most popular browsers on the internet today. Current estimates as of June 2007 believe Firefox makes up 14.55% of the world's web browsers. Being free, cross-platform, and updated regularly is just some of the many reasons many users have made the switch to it. Firefox also allows the user to easily install add-ons to enhance the functionality of the browser. Here are some Firefox files that may be of interest during an investigation with MacForensicsLab.
Firefox stores the user data in the following places:
• Mac OS X: ~/Library/Application Support/Firefox/Profiles//
• Windows XP & 2000: C:Documents and SettingsApplication DataMozillaFirefoxProfiles
• Windows 98 & ME: C:WindowsApplication DataMozillaFirefoxProfiles
or
C:WindowsProfilesApplication DataMozillaFirefoxProfiles
• Windows NT 4.x: C:WinntProfilesApplication DataMozillaFirefoxProfiles
• Unix: ~/.mozilla/firefox//
Website History
File name: history.dat
By default Firefox stores the browsing history for 9 days.
Side note: "history.dat" is written in a complex format called "Mork".
Encrypted Saved Passwords
File name: signons.txt
This file also stores a list of sites to never save the passwords for. The encryption key is contained in the file called key3.db
More information about specific files in the user profile can be found at MozillaZine's Knowledge Base article on the Profile Folder.
