Firefox Preferences

Overview

Firefox stores user preferences in prefs.js, a JavaScript file within each profile directory that contains user_pref() function calls. An optional user.js file can override preferences on every browser startup. These files control nearly every aspect of Firefox behaviour: privacy settings, security policies, network configuration, search engine defaults, UI customisation, and content blocking.

Preferences are forensically relevant because they reveal the user's security posture, privacy choices, network configuration (including proxy settings), and whether anti-forensic measures have been applied (such as disabling history, clearing data on exit, or disabling telemetry).

File Locations

prefs.js vs user.js

The presence of a user.js file is notable because it indicates intentional configuration hardening. Files like those generated by arkenfox/user.js (formerly ghacks-user.js) dramatically alter Firefox's privacy and security behaviour.

File Format

Both files use the same JavaScript format:

// prefs.js example
user_pref("browser.startup.homepage", "https://example.com");
user_pref("browser.startup.page", 3);
user_pref("privacy.donottrackheader.enabled", true);
user_pref("network.proxy.type", 1);
user_pref("network.proxy.http", "proxy.corp.example.com");
user_pref("network.proxy.http_port", 8080);

Each line is a user_pref("key", value) call where:

• The key is a dot-separated preference path.
• The value is a JavaScript literal: string, integer, or boolean.

Comments beginning with // or /* */ may be present but are stripped by Firefox on write.

Key Fields for Analysis

Privacy and Anti-Forensics Settings

Network and Proxy Settings

Security Settings

Content and Tracking Protection

Search and Homepage

Telemetry and Reporting

Timestamps

prefs.js does not contain timestamps within its content. However, the file's filesystem modification time reflects when preferences were last changed. The macfor collector records OriginalModTime from the file metadata.

Analysis Notes

Detecting Anti-Forensic Configuration

A user who has enabled privacy.sanitize.sanitizeOnShutdown with associated privacy.clearOnShutdown.* flags set to true is actively destroying forensic evidence on browser close. Check:

1. Is privacy.sanitize.sanitizeOnShutdown true?
2. Which privacy.clearOnShutdown.* categories are enabled?
3. Is browser.privatebrowsing.autostart true? (Permanent private browsing)
4. Is places.history.enabled false? (History completely disabled)

Identifying Privacy Hardening Tools

The presence of extensive privacy-related overrides, especially in a user.js file, often indicates use of a hardening template:

• arkenfox/user.js: Comprehensive privacy hardening. Look for characteristic preferences like privacy.resistFingerprinting = true, extensive network.cookie.* modifications, and geo.enabled = false.
• LibreWolf defaults: Similar to arkenfox but applied via default preferences.
• Tor Browser settings: Extreme privacy configuration (unlikely in standard Firefox).

Proxy and Network Analysis

Proxy settings reveal network routing:

• Manual proxy (network.proxy.type = 1): Check network.proxy.http and network.proxy.socks for the proxy endpoint.
• PAC file (network.proxy.type = 2): The network.proxy.autoconfig_url may point to an enterprise PAC file.
• SOCKS proxy with DNS via SOCKS (network.proxy.socks_remote_dns = true): May indicate Tor or SSH tunnel usage.
• DNS over HTTPS (network.trr.mode = 2 or 3): DNS queries are encrypted, bypassing local DNS monitoring.

Session Restore Behaviour

The browser.startup.page preference determines what happens on startup:

A value of 3 means the session files in sessionstore-backups/ will be loaded on startup, and session cookies will persist across browser restarts.

Parsing prefs.js

prefs.js is parseable with a simple regex or line-by-line extraction:

Pattern: user_pref\("([^"]+)",\s*(.+)\);
Group 1: preference key
Group 2: preference value (string, integer, or boolean)

Note: The macfor collector currently collects prefs.js as a raw file without structured parsing. Examiners can parse the file manually or with scripting tools.

Version Differences

The prefs.js format itself has been unchanged for decades. New preferences are added with each Firefox release, but the syntax remains the same.

Tool Support

References

• Mozilla Source: Preferences Service
• arkenfox/user.js (GitHub)
• Mozilla: about:config Entries
• SANS FOR518: Mac and iOS Forensic Analysis