Vivaldi Blog

Investigating Vivaldi Web Browser

06/12/2021 Monday

Vivaldi web browser is a cross-platform web browser developed by Vivaldi Technologies. It is best known for being fast, private, and secure as it is capable of blocking ads and trackers. What makes Vivaldi unique is that it comes in with many built-in features, and it puts the user in control of every feature. In Vivaldi, everything is an option, there are no unchangeable rules which gives the user the upper hand in setting how their browser works. The web browser is available for desktop (Windows, macOS, and Linux), and mobile devices (Android).

Digital Forensics Value of Vivaldi Artifacts

Web browser data can be critical to a digital investigation since they serve as a user's window and access point to the World Wide Web and the rest of the world as well. Web browsers have become part of our daily lives; they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.

Location of Vivaldi Artifacts

Vivaldi web browser creates individual folders (profiles) for each user at the following location: C:\Users\%username%\AppData\Local\Vivaldi\User Data\%profilename%.default

Structure of Vivaldi Artifacts

The majority of Vivaldi web browser artifacts are maintained within SQLite database files, each contains multiple tables with information regarding the users’ actions on the software. Such as Vivaldi top sites, history, and downloads; however, some of the artifacts are stored within JSON files such as Vivaldi bookmarks and notes.

Analyzing Vivaldi Artifacts with ArtiFast Windows

This section will discuss how to use Artifast Windows to extract Vivaldi browser artifacts from Windows machines and what kind of digital forensic insights can be gained from the artifacts.

After you have created your case and added evidence for the investigation at the Artifact Parser Selection Phase, you can select Vivaldi web browser Artifacts:

ArtiFast can analyze Vivaldi Bookmarks, Current Session, Current Tabs, Downloads, Favicons, Last Session, Last Tabs, Notes, Search Terms, Speed Dials, Top Sites, URLs, and Visits. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.

Once ArtiFast parser plugins complete processing artifacts for analysis, they can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Vivaldi artifacts in ArtiFast software.

Vivaldi Bookmarks Artifact

Vivaldi bookmarks are the shortcuts to the favorite and bookmarked webpages. The details you can view include:

Added Date/Time - Date/Time when the bookmark was added.
Modified Date/Time - Date/Time when the bookmark was modified.
Last Desktop Visit Date/Time - Last desktop visit date Date/Time.
URL - URL of the bookmarked webpage.
Bookmark ID - Bookmark ID.
Type - Type of the bookmark.
Bookmark Title - Title of the bookmark.
Description - Bookmark description.
Thumbnail - Bookmark thumbnail.

Vivaldi Current Session Artifact

This artifact stores the browser's current available active session information from Vivaldi web browser. The details you can view include:

Date/Time Visited - The Date/Time when the webpage is visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Request URL - Indicates whether a redirect took a place.
Tab ID - Webpage tab ID.
Tab Index - Webpage tab index.
Transition Type - Describes the cause of the navigation to the desired URL.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Vivaldi Current Tabs Artifact

This artifact stores the multiple open tabs in the current available active session information from Vivaldi web browser. The details you can view include:

Date/Time Visited - The Date/Time when the webpage is visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Transition Type - Describes the cause of the navigation to the desired URL.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Requested URL - Indicates whether a redirect took a place.
Tab Id - The webpage tab Id.
Tab Index - The webpage tab index.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Vivaldi Downloads Artifact

The artifact contains information about the downloaded files from Vivaldi web browser. The details you can view include:

Start Date/Time - Date/Time when the item started downloading.
Ended Date/Time - Date/Time when the download ended.
Last Modified Date/Time - Date/Time when the download was last modified.
Last Access Date/Time - Date/Time when the download was last accessed.
Current Path - Current Path.
Target Path - Target Path.
Referrer - The referrer URL.
Item URL - URL of the downloaded item.
Site URL - Site URL
Tab URL - Tab URL
Tab Referrer URL - Tab referrer URL.
Received Bytes - Bytes that were downloaded.
Total Bytes - File size of the download.
Is Opened - Indicates whether the user has opened the downloaded file or not.
Download State - It indicates the state of the downloaded item (Download Complete, Download in Progress/Paused, Download Failed and Download Interrupted/Cancelled).
Etag - Etag
MIME Type - MIME Type.
Original MIME Type - Original MIME Type.

Vivaldi Favicons Artifact

The artifact stores all the small icons associated with a particular webpage that the user has favorited. The details you can view include:

Last Update Date/Time - Last Date/Time the favicon was updated.
Last Requested Date/Time - Last Date/Time the favicon was requested.
Favicon Page URL - Favicon page URL.
Favicon URL - Favicon URL.
Icon Mapping Page URL - Icon URL of the favicon.
Favicon Height - Favicon height.
Favicon Width - Favicon width.

Vivaldi Last Session Artifact

This artifact stores the browser’s previous session information from Vivaldi web browser. The details you can view include:

Date/Time Visited - The Date/Time when the webpage was last visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Transition Type - Describes the cause of the navigation to the desired URL.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Requested URL - Indicates whether a redirect took a place.
Tab ID - The webpage tab ID.
Tab Index - The webpage tab index.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Vivaldi Last Tabs Artifact

This artifact stores the multiple open tabs in the browser's last session from Vivaldi web browser. The details you can view include:

Date/Time Visited - The Date/Time when the webpage was last visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Transition Type - Describes the cause of the navigation to the desired URL.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Requested URL - Indicates whether a redirect took a place.
Tab Id - The webpage tab Id.
Tab Index - The webpage tab index.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Vivaldi Notes Artifact

This artifact stores the notes feature data from Vivaldi web browser. The details you can view include:

Added Date/Time - Note added Date/Time.
Subject - Note subject.
Note Content - Note content.
Note URL - Note URL.
Type - Type.
ID - Note ID.
Has Attachment - Has attachment.
Attachment Info - Attachment ID.

Vivaldi Search Terms Artifact

This artifact stores the user entered terms. The details you can view include:

Visit Date/Time - Date/Time when the webpage was visited.
Search URL - URL that was invoked because of the search.
Searched Term - keyword that was searched.
Page Title - Title of the invoked webpage.
Visit Count - The number of times the user accessed the URL.

Vivaldi Speed Dials Artifact

This artifact contains the information of Vivaldi web browser speed dials. The details you can view include:

Added Date/Time - Date/Time when the speed dial was added.
Modified Date/Time - Date/Time when the speed dial was modified.
Last Desktop Visit Date/Time - Last desktop visit date Date/Time.
URL - URL of the speed dial webpage.
ID - Speed dial ID.
Title - Title of the speed dial.
Type - Type.
Description - Description.
Thumbnail - Speed dial thumbnail.

Vivaldi Top Sites Artifact

This artifact stores information about a user’s most frequently visited webpages. The details you can view include:

Last Update Date/Time - Last update Date/Time.
URL - URL to the webpage.
Title - Title of the webpage.
URL Rank Value - Indicates the order of the most visited webpage.
At Top - At top.
Redirects - Displays the redirection URL which contains the frequently used file path and parameters.

Vivaldi URLs Artifact

This artifact contains Vivaldi URLs information. The details you can view include:

Last Visit Date/Time - Date/Time when the webpage was last visited.
URL - URL.
Title - Title of the URL.
Visit Count - Number of times that the user has visited the webpage.
Typed Count - Number of times that the user has manually typed the web webpage URL.
Is Hidden - Indicates whether the webpage is hidden.

Vivaldi Visits Artifact

This artifact contains more information about each time a URL is visited. The details you can view include:

Visit Date/Time - Date/Time when the webpage was visited.
Visit URL - Visit URL.
Visit Title - Visit title.
Visit Duration - Visit duration in milliseconds.
Transition - Describes the cause of the navigation to the desired URL.
Source URL - Source URL.
Source Title - Source title.
Segment Name - Segment name.