Browser History Viewer¶
Foxton Forensics tool for reviewing browser history, cached pages and images, and other browser artifacts.
When I Use It¶
- Reviewing what a user browsed: phishing link clicks, downloads, searches, and web mail use
- Analyzing a collection from Browser History Capturer
Installation¶
- Download from https://www.foxtonforensics.com/browser-history-viewer/
Common Tasks¶
| Task | Steps |
|---|---|
| Load a capture | File -> Load History -> select the Browser History Capturer output directory |
| Review history | The timeline view shows visits across all browsers in order |
| Review cached content | The cached web pages and cached images tabs |
| Filter | Filter by date range, browser, or keyword |
Reading the Output¶
- The timeline across browsers is the most useful view: it shows the sequence of a click on a phishing link, the page that loaded, and any download that followed
- Visit counts and typed URLs help separate sites a user went to deliberately from ones reached by a redirect
Related¶
- Browser History Capturer
- Phishing playbook