Per StatCounter, Mozilla Firefox has only a .5% stake in mobile browser usage globally. I can only image that number is even further diminished on Android with Chrome's stranglehold. Regardless Josh Hickman gave us some test data to play with in his recent Android 12 image. I also generated some test data further on my Android 11 Pixel 4A for fun. Here's a breakdown of some data that we can pull out.
The main app folder location is as follows:
data\data\org.mozilla.firefox
Let's start with the most significant database file, places.sqlite, which can be found here:
data\data\org.mozilla.firefox\files\places.sqlite*
If you've ever done Firefox forensics on a desktop this will look pretty familiar. Some tables of interest include:
- moz_bookmarks - Bookmarks from the browser
- moz_historyvisits - website history visits
- moz_places - website pages visited
- moz_places_metadata_search_queries - searches done in the browser
- moz_places_metadata - more details about pages visited, including view times (more research to be done on this one)
- moz_tags - you can tag and categorize bookmarks as needed (not sure if this can be done on mobile but table is available, more research to be done on this)
Here we can start to formulate parsers for different artifacts starting with Web History and Web Visits. I always never understood what the difference was until I dove deeper into what is being parsed. History could be a single URL "visited" multiple times and is only tracking the last instance of hitting said URL. Visits lists out each hit (visit) of any URL, so could see more than one entry for each unique URL.
Web History
For History we will want to pull information from the table "moz_places".
moz_places
- last_visit_date_local - time of last visit in Unix Epoch in milliseconds
- url - URL of the webpage
- title - title of the webpage
- visit_count_local - total count of visits to a specific URL
- hidden
- per this site, 1 = user could have gotten to it from RSS or iframe
- typed - 1 = user typed the URL
- frecency - combination of frequency and recents, the higher the value more frequent the user navigated to said page
- preview_image_url - URL to a picture preview, most likely used for homepage
A sample output using my formulated query can be seen below:
Figure 1: Web History output from DB Browser for SQLite
Web Visits
For Visits we can look at the table "moz_historyvisits" as well as pull in some columns from "moz_places".
moz_historyvisits
- visit_date - date of the visit in Unix Epoch in milliseconds
- visit_type - transition type of how the visit was made
- 1 = TRANSITION_LINK
- 2 = TRANSITION_TYPED
- 3 = TRANSITION_BOOKMARK
- 4 = TRANSITION_EMBED
- 5 = TRANSITION_REDIRECT_PERMANENT
- 6 = TRANSITION_REDIRECT_TEMPORARY
- 7 = TRANSITION_DOWNLOAD
- 8 = TRANSITION_FRAMED_LINK
- 9 = TRANSITION_RELOAD
Transition details pull from here.
A sample output using my formulated query can be seen below. Notice the extra columns pulled in using a table join.
Figure 2: Web Visits output from DB Browser for SQLite
Bookmarks
For Bookmarks we can look at the table "moz_bookmarks" naturally, while pulling in URL data from "moz_places".
moz_bookmarks
- dateAdded - date the bookmark was added in Unix Epoch milliseconds
- lastModified - date the bookmark was last modified in Unix Epoch milliseconds
- title - title of the bookmark
- type - the kind of bookmark it is
- 1 = URL
- 2 = Folder
- 3 = Separator (this one may not exist but does in the desktop version)
- id - unique ID of the bookmark itself
- parent - shows ID of the parent folder/item if part of a structure
- position - shows position number if part of a folder or arrangement (0 at top downward)
My query for bookmarks can be found here, see sample results below:
Figure 3: Bookmarks output from DB Browser for SQLite
Search Terms
Searched Terms can be pulled from the simple table "moz_places_metadata_search_queries". It appears to just pull any query used to search by (ex. in Google) from the "moz_places" table.moz_places_metadata_search_queries
- id - unique ID of the search term
- term - the search term queried
Short, sweet and to the point for quickly narrowing down what was searched using the browser. Get the query here if you really need.
Figure 4: Search Terms output from DB Browser for SQLite
These parsers are now available in ALEAPP, with more on the way.
Figure 5: Sample ALEAPP report of Firefox parsers from places.sqlite