Forensic: Analyzing the Web history files

Hello mates! How are you? It's my first post, and I'm very excited to start this series, which is titled "Forensic."

So, here’s a question to kick things off: Why is it important to access browsing history during digital forensic investigations?

For investigations related to digital forensic science, it's crucial for all users of different browsers to be able to retrieve their own browsing histories. This is especially useful in security audits and evidence gathering.

Every time you visit a website or make a search, your browser creates a history file that logs these actions. Each web browser has its own unique history file stored on your computer, but you can't open it directly. The contents are encrypted, meaning they look like gibberish unless you decrypt them. This encryption protects your information from unauthorized access.

However, there are tools, like ChromeHistoryView, that allow access to your browsing history for forensic purposes.

So, let's break the ice and dive into ChromeHistoryView, a tool that helps you access browsing history, even when it's encrypted.

  ChromeHistoryView is a small utility that reads the history data file of Google Chrome Web browser, and displays the list of all visited Web pages in the last days. For each visited Web page, the following information is displayed: URL, Title, Visit Date/Time, Number of visits, number of times that

the user typed this address (Typed Count), Referrer, and Visit ID.

You can select one or more history items, and them export them into html/xml/csv/text file, or copy the information to the clipboard and paste it into Excel.

You can also use this tool to read the history of other Chromium-based Web browsers, like Microsoft

 Edge, Opera, Vivaldi, and others... , 

it's doesn't require any installation process or additional DLL files. In order ti start using it, simply copy the executable file (ChromeHistoryView.exe) to any folder you like, and run it

Steps to Use ChromeHistoryView Tool:

1. Launch the program – Since it's portable, there's no need for installation, as mentioned earlier.
2. Go to Options in the menu.
3. Select Advanced Options.

4. Check the box for "Use the following history file or User Data folder."
5. Choose the browser history file you want to view.

6. You can customize the results by selecting options like:

• Load only the URLs visited in the last {number} of days.
• Load only the URLs visited in the specified date/time range.

Written By: Ammar Yasser