Firefox places.sqlite

Firefox stores your web browsing history in a sqlite db. On windows you can find it in:  Documents and Settings\\Application Data\Mozilla\Firefox\Profiles\xyz.default\. On the mac it is in your home folder: Library/Application support/Mozilla/.

There is a great addon for firefox called SQLite Manager which allows you to run SQLite queries. Using this you can look at the places.sqlite file, which contains your web history data. I am particulalry interested in looking at the paths I take and the following query will pull out pairs of target->referer pages.

SELECT plc2.url AS 'referer', plc1.url AS 'target'
FROM moz_historyvisits vis, moz_historyvisits vis2
INNER JOIN moz_places plc1
ON plc1.id = vis.place_id
INNER JOIN moz_places plc2
ON plc2.id = vis2.place_id
WHERE vis.from_visit = vis2.id

There is a wealth of information in this little file, the visit_type column, for example gives you an indicator of how the URL was reached.

Type ID description
TRANSITION_LINK 1 This transition type means the user followed a link and got a new toplevel window.
TRANSITION_TYPED 2 This transition type is set when the user typed the URL to get to the page.
TRANSITION_BOOKMARK 3 This transition type is set when the user followed a bookmark to get to the page.
TRANSITION_EMBED 4 This transition type is set when some inner content is loaded. This is true of all images on a page, and the contents of the iframe. It is also true of any content in a frame, regardless if whether or not the user clicked something to get there.
TRANSITION_REDIRECT_PERMANENT 5 This transition type is set when the transition was a permanent redirect.
TRANSITION_REDIRECT_TEMPORARY 6 This transition type is set when the transition was a temporary redirect.
TRANSITION_DOWNLOAD 7 This transition type is set when the transition is a download.

For more information on this you can view the Mozilla dev pages and the full places system within firefox is documented over here.

A wealth of further information on this DB is available over at firefox forensics


About this entry