Brave Blog

Investigating Brave Web Browser

27/07/2021 Tuesday

Brave is an open-source web browser developed by Brave Software. Brave web browser is known for its fast performance, security, and privacy. The web browser is available for desktop (Windows and macOS) and mobile devices (Android and iOS).

Digital Forensics Value of Brave Artifacts

Web browser data can be critical to a digital investigation since they serve as a user's window and access point to the World Wide Web and the rest of the world as well. Web browsers have become part of our daily lives thus, they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.

Location of Brave Artifacts

Brave web browser creates individual folders (profiles) for each user at the following location:
C:\Users\%username%\AppData\Local\BraveSoftware\Brave-Browser\User Data\%profilename%.default

Structure of Brave Artifacts

The majority of Brave web browser artifacts are maintained within SQLite database files, each contains multiple tables with information regarding the users’ actions on the software. Such as Brave autofill, history, and logins; however, some of the artifacts are stored within JSON files such as Brave bookmarks.

Analyzing Brave Artifacts with ArtiFast Windows

This section discusses how to use ArtiFast Windows to extract Brave browser artifacts from Windows machines and what kind of digital forensic insights can be gained from the artifacts.

After you have created your case and added evidence for the investigation at the Artifact Parser Selection Phase, you can select Brave web browser Artifacts:

ArtiFast can analyze Autofill, Autofill Profiles, Bookmarks, Cache, Cookies, Current Session, Last Session, Downloads, Extension, Extension Cookies, Favicons, History, Logins, Shortcuts, Search Terms, Site Engagement, Top Sites, Visits, Credit Cards, Ad Service Information, Ad Payment, Publisher Information, User Contributions, Pending Contributions, and Brave Origin Transformation Table. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.

Once ArtiFast parser plugins complete processing artifacts for analysis, they can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Brave artifacts in ArtiFast software.

Brave Ad Payment Artifact

The artifact contains the information about the payment made to user as advertisement reward. The details you can view include:

Balance - The total balance.
Payment Month - The month and year the payment was done.
Transaction Count - The number of the transactions in this month.

Brave Ad Service Information Artifact

The artifact contains contains information about the advertisements served by the browser. The details you can view include:

Start Date/Time - The Date/Time the ad started.
End Date/Time - The Date/Time the ad ended.
Advertiser - The advertiser’s name.
Notification Text - The advertisement notification text.
Notification URL - The advertisement URL.
Category Name - The category name the advertisement belongs to.
Per Day - The number of ads per day.
Total Max - The maximum number of ads per day.
Balance - The total balance.

Brave Autofill Artifact

The artifact contains all of the values that the user has saved to fill in fields at a later date and time. The details you can view include:

Creation Date/Time - The Date/Time when the autofill was created.
Last Used Date/Time - The Date/Time when the autofill was used.
Field Name - The name of the field to fill in.
Field Value - The value typed by the user.
Count - Indicates the number of times the input was used.

Brave Autofill Profiles Artifact

The artifact contains all of the profiles that are used to represent a user. The details you can view include:

Last Modified Date/Time - The Date/Time that the profile was last modified.
Last Used Date/Time - The Date/Time that the profile was last used.
Name - The name of the user.
Email - The user's email address.
Phone Number - The user's phone number.
Company - The company the person works at.
Address - The user's address.
City - The city the person lives in.
State - The state or province the person lives in.
Zipcode - The zip code the person lives in.
Country Code - The country the person lives in.
Use Count - Number of times profile used.

Brave Bookmarks Artifact

Brave Bookmarks are the shortcuts to the favorite and bookmarked webpages. It contains information such as:

Added Date/Time - The Date/Time when the bookmark was added.
Modified Date/Time - The Date/Time when the bookmark was modified.
URL - The URL of the bookmarked webpage.
Bookmark ID - The bookmark ID.
Type - The type of the bookmark.
Bookmark Title - The title of the bookmark.
Thumbnail - The bookmark thumbnail.

Brave Cache Artifact

This artifact contains the cached entries in the Brave web browser. Brave Cache information includes:

Creation Date/Time - The Date/Time when the cached entry was created.
Last Used Date/Time - The Date/Time when the cached entry was last used.
Last Modified Date/Time - The Date/Time when the cached entry was last modified.
Reuse Count - The number of times the use used the cache file.
State - The state of the cache file.
Key - Represents the profile picture URL.
Content Size - The size of the cache file.
Content Type - The type of cache file.
File Name - Represents the cache file name.
Payload - Indicates the cache storage location.
Is Dirty - Indicates whether is dirty or not.
Refetch Count - Indicates the number of times the cached entry was refetched.
Long Key Data - Cache long key data.
HTTP content - HTTP header contents.

Brave Cookies Artifact

The artifact contains information about all of the cookies saved to the browser such as:

Creation Date/Time - The Date/Time when the cookie was created.
Expiration Date/Time - The Date/Time when the extension cookie will expire if it was set to expire.
Last Access Date/Time - The Date/Time when the cookie was last accessed.
Host - The host domain of the cookie.
Name - The name of the cookie.
Value - The value of the cookie.
Path - The path to the cookie.
Is Secure - Indicates whether the connection is secure or not.
Is HTTP Only - Indicates whether the browser supports HTTP Only or not.

Brave Credit Cards Artifact

The artifact contains all of the credit card information the user has saved. The details you can view include:

Last Used Date/Time - The Date/Time when the credit card information was last used.
Expiration Date/Time - The Date/Time when the credit card expires.
Last Modified Date/Time - The Date/Time when the credit card information was last modified.
Card Name - The name of the credit card holder.
Origin - The origin of the credit card information.
Card Number - The credit card number.
Use Count - The number of times that it has been used.

Brave Current Session Artifact

This artifact stores the browser's current available active session information from Brave web browser such as:

Date/Time Visited - The Date/Time when the webpage is visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Requested URL - Indicates whether a redirect took a place.
Tab Id - The webpage tab Id.
Tab Index - The webpage tab index.
Transition Type - Describes the cause of the navigation to the desired URL.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Brave Current Tabs Artifact

This artifact stores the multiple open tabs in the current available active session information from Brave Web browser such as:

Date/Time Visited - The Date/Time when the webpage is visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Transition Type - Describes the cause of the navigation to the desired URL.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Requested URL - Indicates whether a redirect took a place.
Tab Id - The webpage tab Id.
Tab Index - The webpage tab index.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Brave Downloads Artifact

The artifact contains information about the downloaded files from Brave web browser. The details you can view include:

Download Start Date/Time - The Date/Time when the item started downloading.
Download Ended Date/Time - The Date/Time when the download ended.
File Name - The name of the downloaded file.
Path - The absolute path on the device to the downloaded file.
Received Bytes - The bytes that were downloaded.
Download Source - The URL of the file that was downloaded.
Is Opened by User - Indicates whether the user has opened the downloaded file or not.
URL Chain - The File download URL chain.
Total Bytes - The file size of the download.
State - It indicates the state of the downloaded item (Download Complete, Download in Progress/Paused, Download Failed and Download Interrupted/Cancelled).

Brave Extension Artifact

This artifact contains the extension information from Brave web browser. The details you can view include:

Install Date/Time - The Date/Time when the extension was installed.
Long Name - The name of the extension.
Short Name - The short version of the extension's name.
Extension Path - Indicates the extension installation location.
State - Indicates the extension state.
Version Number - The extension version number.
Description - The description of the extension.
Installed by Default - Indicates whether it is installed by default or not.
Installed by OEM - Indicates whether it is installed by OEM or not.

Brave Extension Cookies Artifact

This artifact stores the cookies used by the extensions. The details you can view include:

Creation Date/Time - The Date/Time when the extension cookie was created.
Expiration Date/Time - The Date/Time when the extension cookie will expire if it was set to expire.
Last Access Date/Time - The Date/Time when the cookie was last accessed.
Host - The host name of the cookie.
Name - The name of the cookie.
Path - The path to the cookie.
Value - The value of the cookie.
Encrypted Value - The value of the cookie encrypted.
Is HTTP Only - Indicates whether the browser supports HTTP Only or not.
Is Secure - Indicates whether the connection is secure or not.

Brave Favicons Artifact

The artifact stores all the small icons associated with a particular webpage that the user has favorited. The details you can view include:

Last Update Date/Time - The icon last update Date/Time.
Page URL - The page URL.
Icon URL - The Icon file URL.

Brave History Artifact

The artifact contains the history data, which makes up most of the browsing information about a user. The details you can view include:

Last Visit Date/Time - The Date/Time when the webpage was last visited.
URL - The URL of the visited webpage.
Title - The title of the visited webpage.
Visit Count - The number of times that the user has visited the webpage.
Typed Count - The number of times that the user has manually typed the web webpage URL.
Is Hidden - Indicates whether the webpage is hidden.

Brave Last Session Artifact

This artifact stores the browser’s previous session information from Brave web browser. The details you can view include:

Date/Time Visited - The Date/Time when the webpage was last visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Transition Type - Describes the cause of the navigation to the desired URL.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Requested URL - Indicates whether a redirect took a place.
Tab Id - The webpage tab Id.
Tab Index - The webpage tab index.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Brave Last Tabs Artifact

This artifact stores the multiple open tabs in the browser's last session from Brave web browser. The details you can view include:

Date/Time Visited - The Date/Time when the webpage was last visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Transition Type - Describes the cause of the navigation to the desired URL.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Requested URL - Indicates whether a redirect took a place.
Tab Id - The webpage tab Id.
Tab Index - The webpage tab index.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Brave Logins Artifact

This artifact stores a user’s login information. The details you can view include:

Creation Date/Time - The Date/Time when the data was stored.
Last Used Date/Time - The Date/Time when the data was last used.
Action URL - Login URL of the website.
Username Element - Username HTML element.
Username - The username value.
Black Listed - Indicates that the password is not saved for this item.
Origin URL - Base URL of the webpage.
Password Element - Name of the password field in the webpage.
Password - Password entered.
Signon Realm URL - Sign on realm URL.
Times Used - Number of times the desired credentials were used.

Brave Search Terms Artifact

This artifact stores the user entered search terms. The details you can view include:

Last Visit Date/Time - Date/Time when the webpage was last visited.
Search URL - URL that was invoked because of the search.
Term - keyword that was searched.
Page Title - Title of the invoked webpage.
Visit Count - The number of times that the user accessed the URL.

Brave Shortcuts Artifact

This artifact contains the shortcuts from Brave web browser. The details you can view include:

Last Access Date/Time - Last access time of the shortcut.
URL - URL of the shortcut.
Search Term - Search term as interpreted by the browser.
Original Search Query - Original search query entered by the user.
Web Page Title - Title of the webpage.
Transition - Describes the cause of the navigation to the desired URL.
Hits - Hits of the shortcut.
Type - Type of shortcut.

Brave Browser Site Engagement Artifact

This artifact stores the Site Engagement Service information of how engaged a user is with a site. The details you can view include:

Last Engagement Date/Time - Last Date/Time a user engaged with the webpage.
Last Modified Date/Time - Last modified Date/Time for the webpage.
Last Shortcut Launch Date/Time - Last Date/Time user launched the webpage.
Website URL - The website URL.
Raw Score - Engagement score.

Brave Top Sites Artifact

This artifact stores information about a user’s most frequently visited web pages. The details you can view include:

URL - The URL to the webpage.
Title - The title of the webpage.
URL Rank - Indicates the order of the most visited webpage.
Redirects - Displays the redirection URL which contains the frequently used file path and parameters.

Brave Visits Artifact

This Artifact contains more information about each time a URL is visited. The details you can view include:

Visit Date/Time - Date/Time when the webpage is visited.
Visit URL - URL of the visited webpage.
Visit Title - Title of the visited webpage.
Visit Duration - Visit duration of the visited webpage.
Transition - Describes how the browser navigated to this URL.
Source URL - Source URL.
Source Title - Source title.
Segment Name - Segment name.

Brave Publisher Information Artifact

This artifact contains information about web content publishers and user interaction with the content. The details you can view include:

Donation Add Date/Time - Date/Time donation added.
Publisher ID - Publisher ID.
Publisher Name - Publisher’s name.
Content URL - Published web content URL.
Provider - Provider hosting the content.
Favicon - Short icon URL.
Visits - Number of the visits.
Duration - Duration of the visit.
Donation Amount - Amount of the donation.

Brave User Contribution Artifact

This artifact contains information on contributions to publishers by user. The details you can view include:

Created at Date/Time - Date/Time contribution created.
Contribution ID - ID of the contribution.
Publisher Key - Publisher key.
Total Amount - Total amount contributed to publisher.
Contributed Amount - Amount contributed to publisher.
Retry Count - Contribution retry count.

Brave Pending Contribution Artifact

This artifact contains information on pending contributions to publishers by user. The details you can view include:

Add Date/Time - Date/Time when the contribution was added.
Contribution ID - Pending Contribution ID.
Publisher ID - ID of the publisher.
Amount - Pending amount of the contribution.
Viewing Id - Viewing Id.

Brave Origin Information Table Artifact

This artifact contains information on origin sites visited by user. The details you can view include: