Firefox Bookmarks

Overview

Firefox bookmarks are stored in the same places.sqlite database as browsing history. The moz_bookmarks table maintains a hierarchical tree structure of bookmarks, folders, and separators. Bookmarks reference URLs via the moz_places table, and can be enriched with tags (stored as nested bookmarks under a special Tags folder) and keywords (stored in moz_keywords).

Bookmarks provide forensic evidence of sites a user deemed important enough to save. The folder hierarchy reveals organisational patterns, date-added timestamps show when interest began, and tags indicate how users categorise their saved content.

File Locations

Bookmarks share the same places.sqlite database as history. There is no separate bookmarks file.

Database Schema

moz_bookmarks

CREATE TABLE moz_bookmarks (
    id INTEGER PRIMARY KEY,
    type INTEGER NOT NULL,          -- 1=bookmark, 2=folder, 3=separator
    fk INTEGER DEFAULT NULL,        -- Foreign key to moz_places.id (for bookmarks)
    parent INTEGER,                 -- Parent folder ID
    position INTEGER,               -- Position within parent (0-indexed)
    title LONGVARCHAR,
    keyword_id INTEGER,             -- Associated keyword from moz_keywords
    folder_type TEXT,               -- Special folder designation
    dateAdded INTEGER,              -- PRTime (microseconds since Unix epoch)
    lastModified INTEGER,           -- PRTime (microseconds since Unix epoch)
    guid TEXT NOT NULL UNIQUE,
    syncStatus INTEGER NOT NULL DEFAULT 0,
    syncChangeCounter INTEGER NOT NULL DEFAULT 1
);

moz_keywords

CREATE TABLE moz_keywords (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    keyword TEXT UNIQUE,
    place_id INTEGER,
    post_data TEXT
);

Bookmark Types

Special Folder IDs

Firefox reserves the first six bookmark IDs for system folders:

Key Fields for Analysis

Timestamps

Both dateAdded and lastModified use PRTime format: microseconds since 1970-01-01 00:00:00 UTC.

dateAdded = 1705312200000000
Unix seconds = 1705312200
Result = 2024-01-15T10:30:00Z

Analysis Notes

Reconstructing Folder Paths

Bookmarks form a tree rooted at the Places Root (id=1). To reconstruct the full path to a bookmark, walk the parent chain upward:

WITH RECURSIVE path AS (
    SELECT id, title, parent, type
    FROM moz_bookmarks
    WHERE id = ?  -- Starting bookmark
    UNION ALL
    SELECT b.id, b.title, b.parent, b.type
    FROM moz_bookmarks b
    JOIN path p ON p.parent = b.id
    WHERE b.id > 1  -- Stop at root
)
SELECT * FROM path;

The macfor collector builds a folder path cache in memory for efficient lookups across all bookmarks.

Tag System

Firefox implements tags as a special bookmark structure:

1. The Tags folder (id=4) contains tag folders (type=2), each named after a tag.
2. Each tag folder contains bookmark entries (type=1) that reference the tagged moz_places row via fk.

To find all tags for a given URL:

SELECT tag_folder.title AS tag_name
FROM moz_bookmarks b
JOIN moz_bookmarks tag_folder ON tag_folder.id = b.parent
WHERE b.parent IN (
    SELECT id FROM moz_bookmarks WHERE parent = 4 AND type = 2
) AND b.fk = ?;  -- place_id of the URL

Keywords

Keywords are shortcuts typed in the address bar to navigate directly to a bookmarked URL. A bookmark with keyword gh for https://github.com allows the user to type gh in the address bar. Keywords with post_data indicate form submission shortcuts.

Identifying Forensically Relevant Bookmarks

• Toolbar bookmarks (parent chain includes id=3): Highest visibility, fastest access.
• Recently added (high dateAdded): Recent interests or activity.
• Mobile bookmarks (parent chain includes id=6): Saved on phone, synced to desktop.
• Bookmarks with keywords: Frequently accessed sites.
• Tagged bookmarks: User actively categorised the content.

Useful Queries

All URL bookmarks with folder paths:

SELECT b.id, b.title, p.url, b.dateAdded, b.lastModified,
       parent_folder.title AS parent_folder
FROM moz_bookmarks b
JOIN moz_places p ON p.id = b.fk
JOIN moz_bookmarks parent_folder ON parent_folder.id = b.parent
WHERE b.type = 1
ORDER BY b.dateAdded DESC;

Bookmarks added in a time range:

SELECT b.title, p.url, b.dateAdded
FROM moz_bookmarks b
JOIN moz_places p ON p.id = b.fk
WHERE b.type = 1
  AND b.dateAdded BETWEEN ? AND ?
ORDER BY b.dateAdded;

All tags and their bookmark counts:

SELECT tag_folder.title AS tag_name, COUNT(*) AS bookmark_count
FROM moz_bookmarks b
JOIN moz_bookmarks tag_folder ON tag_folder.id = b.parent
WHERE b.parent IN (
    SELECT id FROM moz_bookmarks WHERE parent = 4 AND type = 2
)
GROUP BY tag_folder.title
ORDER BY bookmark_count DESC;

Version Differences

The bookmark schema itself has been stable across Firefox 78+. The syncStatus and syncChangeCounter columns are present in all supported versions.

Tool Support

References

• Mozilla Source: Bookmarks Schema
• Mozilla Source: Database.cpp
• SANS FOR518: Mac and iOS Forensic Analysis