Blog >> Android Firefox

Investigating Android Firefox

02/8/2024 Friday

Firefox is an open-source web browser that was developed by Mozilla. Android Firefox is known and praised for its security and privacy-concerned approach. The web browser is available for desktop (Windows, macOS and Linux) and for mobile devices (Android and iOS).

Digital Forensics Value of Android Firefox Artifacts

People around the world rely primarily on the Internet as a source of information. At the same time, web browsers are one of the most basic and essential applications for accessing and surfing the Internet. Android Firefox has a large market share worldwide (after Google Chrome and Safari). Given its popularity and wide usage, Android Firefox is considered an important source of evidentiary information in investigations as it enables the investigator to collect valuable and crucial evidence relevant to the case such as the suspect search history, downloads list and cookies.

Location of Android Firefox Artifacts

Android Firefox artifacts can be found at the following location:

data/data/org.mozilla.firefox

All user related details can be found in the previous location except for the historty as it can be found at:

data/data/org.torproject.torbrowser/files/mozilla/****.default

Analyzing Android Firefox Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract Android Firefox artifacts from Android device files and what kind of digital forensics insights we can gain from the artifacts.

After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Skype artifacts:

Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Firefox artifacts in ArtiFast software.

Android Firefox Add-ons Artifact

This artifact contains the add-ons from the Android Firefox web browser. Add-ons includes extensions, themes and plugins. The details you can view include:

• Name - The name of the add-on.
• Description - The description of the add-on.
• Version - The version of the add-on.
• Install Date/Time-UTC - The date/time when the add-on was installed.
• Updated Date/Time - The date/time when the add-on was updated.
• Add-On Disabled - Indicates whether the add-on has been disabled by the user or not.

Android Firefox Bookmarks Artifact

This artifact contains details related to the bookmarked webpages from Android Firefox web browser. The details you can view include:

• Bookmark URL - The URL of the bookmarked webpage.
• Bookmark Title - The title of the bookmark.
• Parent Title - The title of the parent bookmark.
• Added Date - The date/time when the bookmark was created.
• Last Modified Date - The date/time when the field was last modified.

Android Firefox Cache 2 Artifact

This artifact contains the cached entries in the Android Firefox web browser. The details you can view include:

• Cache file Creation Date - The date/time when the cached entry was created.
• Last Modified Date - The date/time when the cached entry was last modified.
• Last Fetched Date - The date/time when the cached entry was last fetched.
• Expiry Date - The date/time when the cached entry will expire.
• Cache Location - The path of the cached file on the disk.
• Key - The Key or URL of the cached file.
• Fetch Count - Indicates the number of times the cached entry was fetched.
• HTTP Content - HTTP header contents.

Android Firefox Cookies Artifact

This artifact contains the cookies from the Android Firefox web browser. The details you can view include:

• Name - The name of the cookie.
• Value - The value of the cookie.
• Host - The host domain of the cookie.
• Path - The path to the cookie.
• Base Domain Name - The name of the base domain.
• Is Secure Connection - Indicates whether the connection is secure or not.
• Is Http Only - Indicates whether the browser supports HttpOnly or not.
• Creation Time - The date/time when the cookie was created.
• Expiration Date - The date/time when the cookie will expire (If the cookie was set to expire).
• Last Access Date - The date/time when the cookie was last accessed.

Android Firefox Current Session Artifact

This artifact contains the webpages from the current session from the Android Firefox web browser. The details you can view include:

• Last Access Date - The date/time when the webpage was last accessed.
• URL - The URL of the webpage.
• ID - ID.
• Original URI - The original URI of the webpage.
• User Typed Value - The value typed by the user.
• Title - The title of the webpage.
• Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
• Previously Visited - Indicates whether the webpage has been visited before.
• Is Closed - Indicates whether the webpage has been closed or not.
• Index - Index.
• Is Hidden - Is hidden.

Android Firefox Downloads Artifact

This artifact contains the downloads from the Android Firefox web browser. The details you can view include:

• Start Date/Time-UTC - The date/time when the item started downloading.
• End Date/Time - The date/time when the download ended.
• Download Source - The URL of the downloaded item.
• Saved To - Indicates the path to where the item was downloaded to.
• File Name - The name of the downloaded item.
• State - Indicates the state of the downloaded item (Download Complete, Download in Progress/Paused, Download Failed and Download Interrupted/Cancelled).
• File Size - The size of the file in bytes.

Android Firefox Favicons Artifact

This artifact contains the favicons from the Android Firefox web browser, which are small icons associated with a particular website or webpage. The details you can view include:

• Expiration Date - The date/time when the icon will expire.
• Icon URL - The URL of the icon.
• Width - The width of the icon.
• Is Root - Indicates whether the icon is root or not.

Android Firefox Form History Artifact

This artifact contains the form history from the Android Firefox web browser. The details you can view include:

• First Used Date - The date/time when the field was first used.
• Last Used Date - The date/time when the field was last used.
• ID - The database row ID.
• Field Name - The form field name.
• Field Value - The saved form field value.
• Used Count - Indicates the number of times the field was used.

Android Firefox History Artifact

This artifact contains the web history from the Android Firefox web browser. The details you can view include:

• Last Visit Date - The date/time when the webpage was last visited.
• Reversed Host - The reversed host.
• Frequency Score - The frequency score.
• Description - The description of the webpage.
• URL - The URL of the webpage.
• Title - The title of the webpage.
• Visit Count - Indicates the number of times the webpage was visited.
• Is Typed - Indicates whether the URL was typed by the user or not.
• Is Hidden - Is hidden.
• Preview Image URL - The URL of the previewed image.

Android Firefox Input History Artifact

This artifact contains the input history from the Android Firefox web browser. The details you can view include:

• Last Visit Date - Last visit date of autocomplete URL.
• Use Count - Indicates the number of times the input was used.
• Title - The title of autocomplete URL.
• Autocomplete URL - Indicates the autocompleted URL.
• Typed Input - The user typed input.

Android Firefox Last Backup Artifact

This artifact contains the last backup from the Android Firefox web browser. The details you can view include:

• Last Access Date - The date/time when the webpage was last accessed.
• URL - The URL of the webpage.
• ID - ID.
• Original URI - The original URI of the webpage.
• Closed At - The date/time when the webpage was closed.
• User Typed Value - The value typed by the user.
• Title - The title of the webpage.
• Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
• Previously Visited - Indicates whether the webpage has been visited before.
• Is Closed - Indicates whether the webpage has been closed or not.
• Index - Index.
• Is Hidden - Is hidden.

Android Firefox Last Session Artifact

This artifact contains the webpages from the last session from the Android Firefox web browser. The details you can view include:

• Last Access Date - The date/time when the webpage was last accessed.
• URL - The URL of the webpage.
• ID - ID.
• Original URI - The original URI of the webpage.
• Closed At - The date/time when the webpage was closed.
• User Typed Value - The value typed by the user.
• Title - The title of the webpage.
• Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
• Previously Visited - Indicates whether the webpage has been visited before.
• Is Closed - Indicates whether the webpage has been closed or not.
• Index - Index.
• Is Hidden - Is hidden.

Android Firefox Logins Artifact

This artifact contains the login details for the websites that the user has logged in using the Android Firefox web browser. The details you can view include:

• Creation Date - The date/time when the data was created.
• Password Last Change Date - The date/time when the password was last changed.
• Password Field - The password entered by the user.
• Encrypted Password - The password entered by the user (encrypted).
• Username Field - The username entered by the user.
• Encrypted Username - The username entered by the user (encrypted).
• Last Used Date - The date/time when the data was last used.
• Host Name - The URL of the login webpage.
• Form Submit URL - The URL where the form is submitted.
• Http Realm - Http Realm
• Guid - The Guid.

Android Firefox Upgrade Backups Artifact

This artifact contains a backup of the webpages from the last active session on Android Firefox web browser. The details you can view include:

• Last Access Date - The date/time when the webpage was last accessed.
• URL - The URL of the webpage.
• ID - ID.
• Original URI - The original URI of the webpage.
• Closed At - The date/time when the webpage was closed.
• User Typed Value - The value typed by the user.
• Title - The title of the webpage.
• Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
• Previously Visited - Indicates whether the webpage has been visited before.
• Is Closed - Indicates whether the webpage has been closed or not.
• Index - Index.
• Is Hidden - Is hidden.

Android Firefox User Account Artifact

This artifact contains all the user saved account details from the Android Firefox web browser. The details you can view include:

• Last Modification Date - The date/time when the account was last modified.
• Account UID - The account UID.
• Account Email - The account email.
• Is Verified - Indicates whether the account was verified.
• Device ID - Indicates the device owner ID.
• Profile Email - The profile email.
• Profile UID - The profile UID.
• Profile Avatar URL - The URL of the profile avatar.
• Profile Display Name - The display name of the profile.
• Is Avatar Default - Indicates whether the user was using the default avatar or not.
• Session Token - The session token.
• Etag - Entity tag.

Android Firefox Visits Artifact

This artifact contains the non-archived visits for the Android Firefox web browser. The details you can view include:

• Visit Date - The date/time when the webpage was visited.
• Title - The title of the visited webpage.
• URL - The URL of the visited webpage.
• Visit Type - Indicates the webpage visit type (how the transition occurred).
• Source URL - The source URL.
• Source Title - The source title.

For more information or suggestions please contact: ekrma.elnour@forensafe.com