Get macfor Pro

Pro plugin

Firefox Browser

Collects Firefox browsing history, downloads, bookmarks, cookies, form history, logins, extensions, and sessions

browser.firefoxPromacOS 10.12+v1.0.0browseruserweb

Run this plugin

Trigger collection for Firefox Browser on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin browser.firefox --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin browser.firefox --dry-run

Compatibility

  • macOS 10.12+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (8 collected, 6 planned)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

Path placeholders

  • {variant_path} is each installed variant's data directory:
    • Firefox — Library/Application Support/Firefox
    • Firefox Developer Edition — Library/Application Support/Firefox Developer Edition
    • Firefox Nightly — Library/Application Support/Firefox Nightly
  • {profile} is each profile listed in profiles.ini (under Profiles/).

history

ArtifactFormatPathNotes
Places Database
places
sqlite~/{variant_path}/{profile}/places.sqlite—

cookies

ArtifactFormatPathNotes
Cookies
cookiesOptionalSensitive
sqlite~/{variant_path}/{profile}/cookies.sqlite—

autofill

ArtifactFormatPathNotes
Form History
formhistoryOptionalSensitive
sqlite~/{variant_path}/{profile}/formhistory.sqlite—

config

ArtifactFormatPathNotes
Site Permissions
permissionsOptional
sqlite~/{variant_path}/{profile}/permissions.sqlite—
Preferences
preferencesOptional
text~/{variant_path}/{profile}/prefs.js—
Content Preferences
content_prefsPlanned — not collected yetOptional
sqlite~/{variant_path}/{profile}/content-prefs.sqlite—
Search Engines
searchPlanned — not collected yetOptional
binary~/{variant_path}/{profile}/search.json.mozlz4—
Profile Timestamps
timesPlanned — not collected yetOptional
json~/{variant_path}/{profile}/times.json—
Container Tabs
containersPlanned — not collected yetOptional
json~/{variant_path}/{profile}/containers.json—

credentials

ArtifactFormatPathNotes
Saved Logins
loginsOptionalSensitive
json~/{variant_path}/{profile}/logins.json—

extensions

ArtifactFormatPathNotes
Extensions
extensionsOptional
json~/{variant_path}/{profile}/extensions.json—

session

ArtifactFormatPathNotes
Session Store
sessionOptional
binary~/{variant_path}/{profile}/sessionstore-backups/recovery.jsonlz4
+2 more
  • ~/{variant_path}/{profile}/sessionstore-backups/recovery.baklz4
  • ~/{variant_path}/{profile}/sessionstore-backups/previous.jsonlz4
—

cache

ArtifactFormatPathNotes
Favicon Cache
faviconsPlanned — not collected yetOptionallow value
sqlite~/{variant_path}/{profile}/favicons.sqlite—

storage

ArtifactFormatPathNotes
Web Storage
webappsstorePlanned — not collected yetOptional
sqlite~/{variant_path}/{profile}/webappsstore.sqlite—