Browser

Browser Artifacts

C:\Users\USERNAME\AppData\Local\Google\Chrome\User Data\Default\
C:\Users\USERNAME\AppData\Local\Microsoft\Edge\User Data\Default\
C:\Users\USERNAME\AppData\Microsoft\Windows\INetCache\IE
C:\Users\USERNAME\AppData\Microsoft\Windows\WebCache\

Chrome

syncdata.sqlite3

Use the SQLite Database Browser to view SQLite database

Last Visited

SELECT urls.id, urls.url, urls.title, urls.visit_count, urls.typed_count, urls.last_visit_time, urls.hidden, visits.visit_time, visits.from_visit, visits.transition, visits.id AS visit_id FROM urls, visits WHERE urls.id = visits.url ORDER BY visits.visit_time

Download

SELECT downloads.id AS id, downloads.start_time,downloads.target_path, downloads_url_chains.url, downloads.received_bytes, downloads.total_bytes FROM downloads, downloads_url_chains WHERE downloads.id = downloads_url_chains.id

Note: Start time is recorded when the Save As Windows is triggered