Firefox Favicons
Overview
Section titled “Overview”Evidence: Firefox Favicons
Description: Collect Firefox Favicons
Category: Applications
Platform: linux
Short Name: ffico
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”Browsers cache the icon of each page they render and record which page the icon belongs to. The favicon database is kept apart from browsing history, so its page URLs corroborate visits from a second source.
Data Collected
Section titled “Data Collected”Parsed rows are stored in browser_favicons.
Firefox Favicons Data
Section titled “Firefox Favicons Data”| Field | Description | Example |
|---|---|---|
ID | ID | 123 |
UserName | User Name | Example value |
BrowserName | Browser Name | Firefox |
Profile | Profile | Example value |
URL | Icon URL | Example value |
IconType | Icon Type | 123 |
Path | Path | Example value |
PageURL | Page the icon belongs to | https://example.com/page |
LastUpdated | Chromium icon time, in UTC. Empty for Firefox and Safari | 2023-10-15 14:30:25+03:00 |
ExpiresAt | Firefox mapping expiry, in UTC. Empty for other browsers | 2023-10-15 14:30:25+03:00 |
IconTimestamp | Safari icon time, in UTC. Empty for other browsers | 2023-10-15 14:30:25+03:00 |
Collection Method
Section titled “Collection Method”The collector copies the favicon database and its -wal, -shm, and -journal companions into the case, then parses page URL and icon URL pairs. It looks under:
/home/*/.mozilla/firefox/*/favicons.sqlite/home/*/snap/firefox/common/.mozilla/firefox/*/favicons.sqlite/home/*/.var/app/org.mozilla.firefox/.mozilla/firefox/*/favicons.sqlite/home/*/.config/mozilla/firefox/*/favicons.sqlite
Forensic Value
Section titled “Forensic Value”Page and icon URL pairs show which pages the browser loaded, including full URLs with query strings, and can be correlated with history, downloads, and other browser artifacts. Clearing history in the browser also removes matching favicon data.