Firefox

Overview

Mozilla Firefox is a Gecko-based browser with a forensically distinct architecture from both Safari and Chrome. It stores artifacts in a profile-based directory structure, uses SQLite databases with Mozilla-specific schemas, and employs a custom JSONLZ4 compression format for session data. Firefox is often favoured by privacy-conscious users and is widely deployed in enterprise environments through its ESR (Extended Support Release) channel.

Firefox uses PRTime timestamps (microseconds since the Unix epoch, 1970-01-01 00:00:00 UTC) for most of its SQLite databases, a unique places.sqlite database that unifies browsing history and bookmarks, and a custom JSONLZ4 format for session recovery files.

Supported Variants

macOS can host multiple Firefox installations, each with its own profile directory:

Cache data is stored separately:

~/Library/Caches/Firefox/Profiles/{profiledir}/cache2/

Profile System

Firefox uses a profile-based architecture where each profile is a self-contained directory with its own databases, configuration, and extension data. Profiles are registered in a profiles.ini file at the root of the Firefox data directory.

profiles.ini Format

[General]
StartWithLastProfile=1
Version=2

[Profile0]
Name=default-release
IsRelative=1
Path=Profiles/a1b2c3d4.default-release
Default=1

[Profile1]
Name=work
IsRelative=1
Path=Profiles/e5f6g7h8.work

[Install308046B0AF4A39CB]
Default=Profiles/a1b2c3d4.default-release
Locked=1

Key fields:

• Name: The human-readable profile name.
• Path: Directory path (relative to the Firefox base directory if IsRelative=1, or absolute).
• IsRelative: Whether Path is relative (1) or absolute (0). Almost always 1.
• Default: Whether this is the default profile (1 = default).
• [InstallXXX]: Maps a Firefox installation hash to its default profile. The Locked=1 flag indicates the profile is locked to that installation.

Profile directory names follow the pattern {random8chars}.{profilename} (e.g., a1b2c3d4.default-release).

INI Profile Parser

The macfor collector uses a Go INI parser (gopkg.in/ini.v1) to enumerate profiles. The parser iterates over [ProfileN] sections, resolves relative paths against the Firefox base directory, and also checks [InstallXXX] sections for installation-to-profile mappings. If no profile has Default=1, the parser falls back to the [Install] section's Default path, and finally to a single-profile heuristic.

Profile Directory Structure

~/Library/Application Support/Firefox/
+-- profiles.ini                        # Profile registry
+-- installs.ini                        # Installation mapping
+-- Profiles/
    +-- a1b2c3d4.default-release/       # Profile directory
        +-- places.sqlite               # History, bookmarks, downloads
        +-- places.sqlite-wal           # Write-ahead log
        +-- places.sqlite-shm           # Shared memory
        +-- favicons.sqlite             # Site icons (Firefox 55+)
        +-- cookies.sqlite              # Cookies
        +-- formhistory.sqlite          # Form autofill
        +-- permissions.sqlite          # Site permissions
        +-- content-prefs.sqlite        # Per-site preferences
        +-- webappsstore.sqlite         # DOM localStorage
        +-- logins.json                 # Encrypted credentials
        +-- key4.db                     # NSS key database
        +-- cert9.db                    # Certificates
        +-- prefs.js                    # User preferences
        +-- extensions.json             # Extension metadata
        +-- extensions/                 # Installed extensions (XPI files)
        +-- sessionstore-backups/
        |   +-- recovery.jsonlz4        # Current session
        |   +-- recovery.baklz4         # Session backup
        |   +-- previous.jsonlz4        # Previous session
        +-- storage/
            +-- default/                # Extension storage
                +-- moz-extension+++{id}/

Artifact Database Files

Timestamps

Firefox uses PRTime for most database timestamps: microseconds since 1970-01-01 00:00:00 UTC.

PRTime value:   1706234567000000
Conversion:     1706234567000000 / 1000000 = 1706234567 (Unix seconds)
Result:         2024-01-25T22:22:47Z

Exceptions:

• Cookie expiry (moz_cookies.expiry): Unix timestamp in seconds.
• Login timestamps (logins.json): Unix milliseconds.
• Session timestamps (recovery.jsonlz4): Unix milliseconds.
• Permission modification time (moz_perms.modificationTime): Unix milliseconds.

JSONLZ4 Format

Firefox uses a Mozilla-specific LZ4 compression format for session files and some configuration files (e.g., search.json.mozlz4, addonStartup.json.lz4).

Binary Structure

Decompression requires LZ4 block decompression (not the more common frame format). The macfor collector caps decompressed output at 100 MB to prevent memory exhaustion from malicious or corrupt files.

Affected Files

Version Differences

Collection Order

The macfor Firefox collector processes artifacts in this order for each profile:

1. profiles.ini (metadata, per variant)
2. places.sqlite (history, bookmarks, downloads -- from same database)
3. cookies.sqlite
4. formhistory.sqlite
5. permissions.sqlite
6. logins.json + key4.db (credential metadata)
7. extensions.json
8. sessionstore-backups/ (JSONLZ4 session files)
9. prefs.js

For each SQLite database, the collector copies the database along with its WAL and SHM files, then opens a read-only copy to parse records without modifying the original.

Tool Support

References

• Mozilla Source: Places Database
• Mozilla Source: nsINavHistoryService.idl (visit types)
• SANS FOR518: Mac and iOS Forensic Analysis
• DFIR.Training Firefox Forensics
• LZ4 Block Format Specification
• NSS (Network Security Services) Documentation