Firefox Form History

Overview

Firefox stores form autofill data in formhistory.sqlite, a dedicated database separate from browsing history. Each entry records a form field name, the value entered by the user, how many times the value was used, and when it was first and last used. This data powers Firefox's autocomplete suggestions when users interact with web forms.

Form history is one of the most forensically revealing browser artifacts. It captures search engine queries, usernames, email addresses, physical addresses, and other data the user typed into web forms. The fieldname column identifies the type of data, while value contains the actual text entered.

File Locations

Database Schema

moz_formhistory

CREATE TABLE moz_formhistory (
    id INTEGER PRIMARY KEY,
    fieldname TEXT NOT NULL,
    value TEXT NOT NULL,
    timesUsed INTEGER,
    firstUsed INTEGER,              -- PRTime (microseconds since Unix epoch)
    lastUsed INTEGER,               -- PRTime (microseconds since Unix epoch)
    guid TEXT
);

CREATE INDEX moz_formhistory_index ON moz_formhistory (fieldname);

Key Fields for Analysis

Common Field Names

Timestamps

Both firstUsed and lastUsed use PRTime: microseconds since 1970-01-01 00:00:00 UTC.

lastUsed = 1706234567000000
Unix seconds = 1706234567
Result = 2024-01-25T22:22:47Z

The time span between firstUsed and lastUsed combined with timesUsed reveals patterns of repeated behaviour.

Analysis Notes

Search Query Extraction

The most valuable forensic data in form history is often search queries. Firefox stores search bar input under the field name searchbar-history, while individual site search forms use their own field names:

SELECT value, timesUsed, firstUsed, lastUsed
FROM moz_formhistory
WHERE fieldname IN ('searchbar-history', 'q', 'query', 'search_query',
                    'search', 's', 'p', 'wd', 'text')
ORDER BY lastUsed DESC;

Username and Email Discovery

SELECT fieldname, value, timesUsed, firstUsed, lastUsed
FROM moz_formhistory
WHERE fieldname IN ('username', 'login', 'email', 'user', 'login_field',
                    'userid', 'user_id', 'emailAddress', 'user_name')
ORDER BY lastUsed DESC;

Timeline of Activity

Form history entries with timestamps create a timeline of user interaction with web forms:

SELECT fieldname, value, firstUsed, lastUsed, timesUsed
FROM moz_formhistory
WHERE lastUsed BETWEEN ? AND ?
ORDER BY lastUsed DESC;

High-Frequency Values

Values with high timesUsed counts indicate habitual behaviour:

SELECT fieldname, value, timesUsed, firstUsed, lastUsed
FROM moz_formhistory
WHERE timesUsed > 5
ORDER BY timesUsed DESC;

Privacy and Sensitivity

Form history may contain highly sensitive data:

• Medical or legal search terms revealing health conditions or legal issues.
• Financial information including partial account numbers.
• Personal communications entered in web-based forms.
• Passwords accidentally typed into username fields.

The macfor collector preserves the raw value field in parsed records. Examiners should handle form history data with appropriate care and relevance filtering.

Data Retention

Firefox does not automatically purge form history entries by default. Old entries may persist for years unless the user manually clears form data via Preferences or uses "Clear Recent History." The timesUsed count continues to increment across all browser sessions.

Version Differences

The moz_formhistory schema has been stable across all supported Firefox versions (78+). Newer versions may store structured autofill data (credit cards, addresses) in a separate JSON-based system managed by the Form Autofill feature, but the traditional formhistory.sqlite continues to capture standard form field values.

Tool Support

References

• Mozilla Source: FormHistory Storage
• Mozilla Wiki: Form Autofill
• SANS FOR518: Mac and iOS Forensic Analysis