Autopsy web history recovery: step-by-step guide for forensic examiners

Key takeaways

• Always work on a verified forensic image, never the original drive.
• The Recent Activity ingest module extracts browser artefacts into Extracted Content.
• Chrome and Firefox keep history in SQLite databases, which you can verify by hand.
• Chrome stores times as microseconds since 1601, which Autopsy converts for you.
• Record hashes, settings and tool versions so another examiner can repeat your work.

What is Autopsy?

Autopsy is a free, open-source digital forensics platform built on The Sleuth Kit. It reads disk images and lets you browse files, recover deleted ones and extract artefacts such as browser history. Download and documentation are at autopsy.com. Use it on images of your own practice disks or on authorised cases.

How do you prepare the evidence?

1. Work from a forensic image. Never open the original drive. See our guide to the phases of digital forensics for how an image is made.
2. Hash the image and compare with the hash recorded at acquisition.

$ sha256sum case001.img

1. Keep a copy read-only and record the hash in your case notes.

How do you create a case and add the image?

1. Open Autopsy and choose New Case.
2. Enter the case name, number and examiner. This feeds the report.
3. Choose Add Data Source, then Disk Image or VM File, and select the image.
4. In the ingest module list, select at least Recent Activity, Hash Lookup, File Type Identification and Extension Mismatch Detector.
5. Start ingestion and wait. Large images take time.

Record the ingest settings and your Autopsy version in your notes.

Where do you find web history?

In the tree on the left, open Extracted Content. The browser artefacts are grouped:

• Web History: URLs visited, page titles, visit counts and last-visited times.
• Web Downloads: files downloaded through the browser.
• Web Cookies: cookies stored by sites.
• Web Search: search terms found in URLs.
• Web Bookmarks and Web Form Autofill where present.

Click a result and look at the lower pane for the source file, which tells you which browser and which user profile it came from.

How do browsers store history?

Chrome and Chromium-based browsers store history in an SQLite file called History in the user profile. Firefox uses places.sqlite. You can inspect a copy of the file yourself to double-check what Autopsy shows.

$ sqlite3 History_copy "SELECT url, title,
 datetime(last_visit_time/1000000-11644473600,'unixepoch')
 FROM urls ORDER BY last_visit_time DESC LIMIT 10;"

Chrome stores times as microseconds since 1 January 1601 (UTC). The expression above converts it to a normal date. Autopsy does this for you, but doing it once by hand helps you trust the tool.

What about deleted history and private browsing?

Deleted history may survive in unallocated space, in SQLite free pages or in the write-ahead log file. Autopsy can recover some of it, but nothing is guaranteed. Private browsing leaves fewer traces in the browser database, though other artefacts such as DNS cache, memory or system logs may remain.

How do you keep the evidence defensible?

• Work only on the verified image.
• Record every step, setting, tool version and hash.
• Note the time zone of the system and of your report. Mixing them is a common error.
• Separate facts ("this URL was visited at this time according to the database") from interpretation ("the user intended to...").
• Export a report from Autopsy and keep it with the case file.

What mistakes do examiners make?

• Skipping the hash check before analysis.
• Reading timestamps in the wrong time zone.
• Treating a cached page as proof the user viewed it on purpose.
• Forgetting that several people may share one Windows account.

Where does this fit?

Web history is one layer of a wider investigation. For the full picture see what digital forensics is.

Next steps

Practise on a public training image with an instructor, using our CHFI course. To preserve online evidence at capture time, see Hunchly for digital evidence.

Related reading

• Mastering Burp Suite: A Step-by-Step Guide to Ethical Brute Force Testing