Firefox on Android - Downloads, Top Sites & Recently Closed Tabs

Web History, Visits, Bookmarks & Search Terms

Like all browsers there are so many artifacts to find on people's web habits. In this post we'll continue on to Firefox's Downloads, Top Sites and Recently Closed Tabs on Android. These three can be found generally in the following location:

data\data\org.mozilla.firefox\databases

Downloads

Downloads can be found in the database here:

data\data\org.mozilla.firefox\databases\mozac_downloads_database*

Inside the SQLite database is only one table of interest, "downloads". It's a fairly simple table and pretty self explanatory by the column headers:

created_at - the created/downloaded timestamp in Unix Epoch milliseconds
file_name - name of the file being downloaded with file extension (if applicable)
url - URL of where the file was downloaded from
content_type - MIME type of the file (ex. image/png or application/octet-stream)
content_length - size (in bytes) of the file
status - status of the file download

3 = Paused
4 = Canceled
5 = Failed
6 = Finished

I'm not sure at this time if there are more status as these were the major ones I could figure out. It does seem odd that the numbering would start at 3.

Here is the results using my query in DB Browser:

Figure 1: Firefox downloads in DB Browser for SQLite

Top Sites

Top Sites are basically your top visited webpages that will show on your homescreen of Firefox as such:

Figure 2: Top Sites in Firefox

You can see Google, Top Articles and Wikipedia are pinned by default, and I also have a few other sites that I've frequented to generate test data. These don't get automatically pinned as a Top Site though. For that you have to go through some extra steps. First have to navigate to whatever page you want, then select the three dots menu, and then choose "Add to top sites".

Figure 3: Adding a top site to Firefox on Android

From a forensics perspective you can find the Top Sites database file here:

data\data\org.mozilla.firefox\databases\top_sites*

Opening the database we only see one table of interest, "top_sites". Columns include:

created_at - created date of the Top Site in Unix Epoch milliseconds
title - title of the webpage
url - URL of the webpage
is_default - will show if it was a Top Site by default

0 = No
1 = Yes

Grab the query here if you need.

Figure 4: Firefox Top Sites in DB Browser for SQLite

Recently Closed Tabs

As the artifact name suggest, Recently Closed Tabs keeps a running list of tabs that were closed. This is of course the last webpage that tab was on before it was closed. The database can be found at the path:

data\data\org.mozilla.firefox\databases\recently_closed_tabs*

Once again we get another simple database with only one table of interest, you guessed, "recently_closed_tabs". Columns of use are the same as Top Sites:

created_at - created date of the Top Site in Unix Epoch milliseconds
title - title of the webpage
url - URL of the webpage

With the query found here we get the following results:

Figure 5: Firefox Recently Closed Tabs in DB Browser for SQLite

As with the previous post, ALEAPP parsers are already live!

Figure 6: Sample output in ALEAPP