firefox-visits

Parses Firefox browser's places.sqlite database file and retrieves website visit history. Extracts the URL, title, visit count, typed count, and hidden status for entries with one or more visits from the places table.

Command properties

Item	Description
Command type	Driver query
Required permission	None
License usage	Counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

firefox-visits [zippath=STR] [zipcharset=STR] FILE_PATH

Options

zippath=STR: Path to the ZIP file containing the places.sqlite file. Use this to query SQLite files directly inside a ZIP archive.
zipcharset=STR: Character set for ZIP file entries (default: utf-8)

Target

FILE_PATH: Path to the Firefox places.sqlite file to query. You can use a wildcard (*) to specify multiple files.

Output fields

Field	Type	Description
`_time`	timestamp	Last visit time
`title`	string	Web page title
`visit_count`	integer	Number of visits
`typed_count`	long	Number of times the URL was typed directly in the address bar
`hidden`	boolean	Whether the entry is hidden. Assigned `true` for visits made via redirect, etc.
`url`	string	Visited URL

Error codes

Parse errors

N/A

Runtime errors

Error code	Message	Description	Post-processing
-	cannot load firefox places database: PATH	Unable to read the Firefox places database	Stops query execution

Description

The firefox-visits command parses the moz_places table of the places.sqlite file where Firefox stores its visit history. Entries with a visit count (visit_count) of 0 are excluded because their last_visit_date is NULL.

The hidden field is assigned true if the hidden column in the moz_places table is 1, and false otherwise. Timestamps are converted from UNIX timestamps in microseconds to milliseconds and assigned as dates.

Examples

Retrieve Firefox visit history
```
firefox-visits /opt/logpresso/evidence/places.sqlite
```
Retrieves all visit history from the places.sqlite file at the specified path.
Retrieve the top 10 most-visited sites
```
firefox-visits /opt/logpresso/evidence/places.sqlite
| sort -visit_count
| limit 10
```
Retrieves the top 10 visit history entries in descending order of visit count.
Query a places.sqlite file inside a ZIP archive
```
firefox-visits zippath=/opt/logpresso/evidence/browser.zip places.sqlite
```
Retrieves visit history from the places.sqlite file inside the ZIP archive.