Firefox Bookmarks
Overview
Section titled “Overview”Evidence: Firefox Bookmarks
Description: Collect Firefox Bookmarks
Category: Applications
Platform: macos
Short Name: fbkmrks
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Firefox bookmarks are the sites and folders a user saved in the browser. They show habitual resources and, in an investigation, can point to staging portals, internal tools, or infrastructure the user chose to keep.
Data Collected
Section titled “Data Collected”Parsed rows are stored in the shared browser bookmarks table.
Firefox Bookmarks Data
Section titled “Firefox Bookmarks Data”| Field | Description | Example |
|---|---|---|
UserName | macOS account that owns the profile | Example value |
ProfileName | Firefox profile directory name | Example value |
BrowserName | Browser name | Firefox |
GUID | Bookmark GUID from Firefox | Example value |
BookmarkID | Bookmark row ID | Example value |
Name | Bookmark or folder title | Example value |
Type | url or folder | url |
URL | Bookmarked address. Empty for folders | Example value |
ParentFolder | Name of the parent folder. Items directly under a root use the root name | Bookmarks Toolbar |
DateAdded | When the bookmark was added, in UTC. Empty when Firefox has no date | 2023-10-15 14:30:25+03:00 |
DateLastUsed | Last visit time of the bookmarked URL. Firefox does not store a separate bookmark-use time | 2023-10-15 14:30:25+03:00 |
DateModified | When the bookmark was last modified, in UTC | 2023-10-15 14:30:25+03:00 |
FolderPath | Folder chain below the root, joined with / | Design / Type |
Root | Bookmark tree: Bookmarks Toolbar, Bookmarks Menu, Other Bookmarks, or Mobile Bookmarks | Bookmarks Toolbar |
SourceFile | File the row came from | places.sqlite |
Collection Method
Section titled “Collection Method”The collector reads each Firefox profile places.sqlite under ~/Library/Application Support/Firefox/Profiles. It copies the database and its companion files into the case, and any bookmarkbackups files. It parses the live bookmark tree: Bookmarks Toolbar, Bookmarks Menu, Other Bookmarks, and Mobile Bookmarks. Tag entries, separators, and backup files are not parsed.
Forensic Value
Section titled “Forensic Value”Bookmark analysis identifies targeted websites, phishing pages, command-and-control servers, internal resources, and organizational reconnaissance patterns. Investigators can detect social engineering campaigns, credential harvesting attempts, and lateral movement preparation.