Mac Browser History Forensics

← Canonical HubThis page is part of the Mac Forensics cluster. Return to the hub for the full artifact index and cross-cluster context.

Quick Answer. Mac Browser History Forensics parses the browser-specific SQLite stores on macOS: Safari (~/Library/Safari/History.db, Downloads.plist, TopSites.plist, Bookmarks.plist), Chrome/Chromium (~/Library/Application Support/Google/Chrome/Default/History), Firefox (~/Library/Application Support/Firefox/Profiles/*/places.sqlite). We recover URLs, visit timestamps and counts, redirects, form field values (Autofill), download provenance, search terms, and — via APFS snapshots and free-space carving — often the browsing that a user attempted to erase.

Safari — the default macOS browser

Artifact	Path	Contents
History.db	~/Library/Safari/History.db	history_items (URL, visit_count), history_visits (timestamp, redirect_source)
Downloads.plist	~/Library/Safari/Downloads.plist	Each download: URL, destination, bytes, sandbox ID
TopSites.plist	~/Library/Safari/TopSites.plist	Frequently visited (pinned, ranked)
Bookmarks.plist	~/Library/Safari/Bookmarks.plist	Bookmark tree with date added
LastSession.plist	~/Library/Safari/LastSession.plist	Tabs open at last quit — even in Private Browsing when tabs restored
UserNotificationPermissions	~/Library/Safari/UserNotificationPermissions.plist	Sites granted notification permission
Autofill	Keychain + AutoFillCorrectionList.plist	Form field defaults and corrections
iCloud Tabs	~/Library/SyncedPreferences/com.apple.Safari.plist	Tabs synced from other Apple devices
CloudTabs	~/Library/SyncedPreferences/com.apple.mobilesafari.plist	iOS Safari tab sync — links Mac to iPhone/iPad

Chrome and Chromium-family browsers

Chrome stores its data under ~/Library/Application Support/Google/Chrome/Default/ (or another profile directory). Key files:

• History — SQLite: urls, visits, downloads, keyword_search_terms
• Cookies — SQLite: host_key, name, value, expires_utc
• Login Data — SQLite: origin_url, username_value, password_value (encrypted with Keychain-derived key)
• Web Data — Autofill entries, saved credit cards
• Bookmarks — JSON with dateAdded timestamps
• Extension State, Extension Cookies — activity by installed extensions
• Cache/ and Code Cache/ — HTTP response bodies keyed by SHA-1

Edge, Brave, Opera, Arc, and Vivaldi use the same schema at their own paths — the analysis process is identical.

Firefox

Under ~/Library/Application Support/Firefox/Profiles/<profile>/:

• places.sqlite — moz_places (URL), moz_historyvisits (timestamp, transition type), moz_bookmarks
• cookies.sqlite
• formhistory.sqlite — form field autocompletion history
• downloads.sqlite / places.sqlite moz_annos — download destinations
• sessionstore.jsonlz4 — currently open tabs and history stack
• logins.json + key4.db — saved credentials (encrypted)

Private / incognito browsing

Private / Incognito modes deliberately avoid writing to History and Cookies. Evidence still commonly recovers from:

• Memory captures — RAM contains URL strings and page fragments until reboot.
• Swap and sleep image — /private/var/vm/ may retain browsing content after logoff.
• DNS records — com.apple.mDNSResponder Unified Log entries show resolved hostnames even for private tabs.
• Router / firewall logs — when preserved by counsel or corporate IT.
• APFS snapshots — if a snapshot was created during a private session, the ephemeral files inside the browser sandbox can persist there.

How Elite Digital Forensics helps

Elite Digital Forensics is an independent, defense-aligned Mac forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Mac Forensics hub for the full analytical framework we bring to every matter.

Related Mac forensics pages

Frequently asked questions