Firefox places.sqlite Database

places.sqlite is the SQLite database file that stores history for Mozilla's Firefox browser. It also stores additional data such as favicons, bookmarks, and input history (used for autofill).

Analysis Value

Operating System Availability

  • Systems with Mozilla Firefox installed

Artifact Location(s)

  • %UserProfile%\AppData\Roaming\Mozilla\Firefox\Profiles\{FIREFOX_PROFILE}\places.sqlite*

Artifact Parsers

Artifact Interpretation

The following tables are present in this SQLite database:

In newer versions of Firefox (Firefox 55.0+), the moz_favicons table has been moved to its own unique database under the same directory, favicons.sqlite.

Firefox Bookmarks

The browser bookmark data for Firefox is stored in the moz_bookmarks table of this database. It has the following structure:

Firefox Favicons

The stored favicons for visited websites are stored either in the places.sqlite database for Firefox versions below 55.0, and in its own separate SQLite database favicons.sqlite for versions afterwards. The structure is as follows:

Firefox History

The browsing history for a particular Firefox profile can be extracted from the moz_historyvisits table. It has the following structure:

The following visit_type enumerations can provide additional information regarding how the site was visited:

  1. Link followed to visit the URL

  2. URL was typed and visited, or selected from an autocomplete result in the search bar

  3. URL was visited through a bookmark

  4. URL was embedded on another page

  5. URL visited through a permanent redirect (HTTP 301)

  6. URL visited through a temporary redirect (HTTP 307)

  7. URL is a downloaded resource

  8. URL was visited in a frame

  9. URL was visited because the page was reloaded

Last updated