Browser Forensics

Firefox profiles

Firefox profiles

Firefox based browsers (and Thunderbird) store their profiles in the following files in the profile folder (usually XXXXXXXX.default):

File	Description
`places.sqlite`	Bookmarks, history, cookies, etc…
`keyN.db` with N=3 or 4	Master password, used to encrypt the stored passwords
`signons.sqlite` or `logins.json`	Stored passwords
`certN.db` with N=8 or 9	Certificates

Dumpzilla - GitHub
Dumps everything from a Firefox profile.
```
python3 dumpzilla.py /path/to/your-profile/
```
Uses NSS to decrypt passwords, which can be hard to install.
Firefox decrypt - GitHub
Decrypts passwords from Firefox. Better support than dumpzilla but don’t handle legacy profiles (key3.db).
```
python3 firefox_decrypt.py /path/to/your-profile/
```
Uses NSS to decrypt passwords, which can be hard to install. Similar to nss-password which can be installed with a .deb file.
FirePWD - GitHub
Decrypt all types of firefox passwords (including legacy).
```
python3 firepwd.py -d /path/to/your-profile/
```
It does not use NSS to decrypt passwords, which makes it easier to install. Found this tool here.