Find deleted Firefox history
Have an employee who is deleting certain Firefox history items. Looking at history the standard way reveals large blocks of time with no history, when I know they were using the computer. I know individual items can be deleted from history. Where can I find the deleted items? Thanks in advance for any assistance.
All Replies (2)
Hi elwopo, Firefox does not retain deleted history items; for example, there is no salvage bin.
If you were to hire a forensic investigator, they might be able to find "deleted" data within the places.sqlite database file if those records have not be overwritten by new history. However, I am not familiar with the technical details of how one would do that, or DIY tools to do it yourself. Also, if the database is compacted ("vacuumed" in SQLite terminology) then disk-level tools would be needed to recover the deleted version of the file.
You may need to collect browsing information at your internet gateway or through a proxy server to compensate for deleted history. Or I suppose some kind of snooping software could be installed on the computer itself.
Perhaps I should mention that if your colleague is using a private browsing window, then the history is never written to disk and would not be recoverable using forensic tools. In that case, you would need to use one of the other methods to monitor usage in real time.