Dump Firefox Preferences
Overview
Section titled “Overview”Evidence: Dump Firefox Preferences
Description: Dump Firefox Preferences
Category: Applications
Platform: windows
Short Name: fprefs
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Browser preference files store sign-in, sync, and per-profile settings. During an infostealer investigation they show whether a browser profile was signed in, whether sync was enabled, and which account settings the browser stored.
Firefox stores these settings in prefs.js and, when present, user.js.
Data Collected
Section titled “Data Collected”The collector copies the preference files into the acquired evidence. It does not parse them into Investigation Hub tables.
Collection Method
Section titled “Collection Method”The collector copies these files when they exist:
Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\prefs.jsUsers\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\user.jsDocuments and Settings\*\Application Data\Mozilla\Firefox\Profiles\*\prefs.jsDocuments and Settings\*\Application Data\Mozilla\Firefox\Profiles\*\user.jsUsers\*\AppData\Local\Packages\Mozilla.Firefox*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\prefs.jsUsers\*\AppData\Local\Packages\Mozilla.Firefox*\LocalCache\Roaming\Mozilla\Firefox\Profiles\*\user.js
Forensic Value
Section titled “Forensic Value”The copied files let an analyst inspect sync status, signed-in accounts, and related browser settings from the evidence itself.
Preference files can contain account identifiers and sync settings. Handle them with the same access controls as other browser evidence.