Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records

Firefox 3 uses a new system, based on various SQLite databases, to store Internet history, bookmarks, form field data and cookies. This paper presents the main properties of these databases, what fields are of forensic interest and what information the available tools can extract. It shows that even if records in these databases are deleted, remnants may be found in unallocated disk space, due to the fact that SQLite utilizes temporary transaction files. The paper proposes an algorithm to recover deleted SQLite entries based on known internal record structures. The tool developed can recover deleted history records and the methodology applied in this work can be used with other applications that also employ SQLite databases.