Browser Artifacts

Web browsers store a wealth of forensic evidence including browsing history, downloads, cookies, saved credentials, bookmarks, extensions, and session data. macOS ships with Safari, but Chrome and Firefox are commonly installed.

Each browser uses different storage formats and file locations, but the forensic categories are largely consistent across browsers.