{"id":47672918,"url":"https://github.com/codyjdalton/browser-analyzer","last_synced_at":"2026-04-02T13:02:37.776Z","repository":{"id":348152654,"uuid":"1196703560","full_name":"codyjdalton/browser-analyzer","owner":"codyjdalton","description":"Forensic tool for searching browser history and activity, a replacement / alternative to BrowserHistoryView","archived":false,"fork":false,"pushed_at":"2026-03-31T01:36:17.000Z","size":1061,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-31T04:52:01.993Z","etag":null,"topics":["browserhistory","browserhistoryview","browsers","digital","forensics","history"],"latest_commit_sha":null,"homepage":"https://codydalton.com","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/codyjdalton.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-31T00:45:51.000Z","updated_at":"2026-03-31T01:36:21.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/codyjdalton/browser-analyzer","commit_stats":null,"previous_names":["codyjdalton/browser-analyzer"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/codyjdalton/browser-analyzer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codyjdalton%2Fbrowser-analyzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codyjdalton%2Fbrowser-analyzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codyjdalton%2Fbrowser-analyzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codyjdalton%2Fbrowser-analyzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/codyjdalton","download_url":"https://codeload.github.com/codyjdalton/browser-analyzer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codyjdalton%2Fbrowser-analyzer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31306710,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-02T12:59:32.332Z","status":"ssl_error","status_checked_at":"2026-04-02T12:54:48.875Z","response_time":89,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["browserhistory","browserhistoryview","browsers","digital","forensics","history"],"created_at":"2026-04-02T13:02:25.854Z","updated_at":"2026-04-02T13:02:37.695Z","avatar_url":"https://github.com/codyjdalton.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Browser History Analyzer\n\nA Linux and Windows desktop application for importing, parsing, analyzing, and exporting web browser history, search queries, and bookmarks from Brave, Chrome, Chromium, Edge, Opera, and Firefox. Can be used on the target machine or an imported `History` or `Bookmarks`, etc. file. \n\nBuilt with Electron and Node.js. Distributed as a portable AppImage (Linux) or portable EXE (Windows) — no installation required. Inspired by BrowserHistoryView, the utility by Nirsoft which is Windows only. I started with feature parity and added a few useful additions such as viewing search history, highlighting suspicious urls, and a user-friendly UI. Like BrowserHistoryView, the full list of urls can be exported to CSV for deeper analysis.\n\n\u003e **Disclaimer:** This tool is intended for forensic, investigative, or educational purposes only. Use responsibly and in accordance with applicable laws and policies.\n\n![Searches tab](tool-screenshot1.png)\n\n![URLs tab](tool-screenshot2.png)\n\n## Features\n\n- **Multi-browser support** — Brave, Chrome, Chromium, Edge, Opera, and Firefox with automatic profile discovery\n- **File upload mode** — Load History or Bookmarks files directly from disk for analysis (useful for examining files from another machine or forensic image)\n- **Three analysis views** — URLs (full history), Searches (extracted search queries), and Bookmarks\n- **Suspicious activity detection** — Flags URLs/titles matching profanity, data exfiltration tools, hacking resources, anonymization services, insider threat indicators, and 90+ forensic keywords\n- **Search extraction** — Pulls search terms from the browser's `keyword_search_terms` database table and detects searches from URL patterns (Google, Bing, DuckDuckGo, Yahoo, Brave Search, YouTube, Amazon, Reddit, Baidu, Yandex)\n- **Bookmark parsing** — Reads Chromium Bookmarks JSON files with full folder path breadcrumbs\n- **Duplicate filtering** — Groups visits by URL, sums durations, shows first/last visit times\n- **Date range filtering** — Custom date picker with \"from the beginning of time\" option\n- **Column sorting** — Click any column header to sort ascending/descending\n- **Pagination** — 15 records per page with navigation controls\n- **CSV export** — Export any tab's data to CSV with proper RFC 4180 escaping\n- **Text search** — Real-time filtering across URL and title fields\n\n## Supported Browsers\n\nThe app automatically scans for browser profiles in these locations:\n\n#### Linux\n\n| Browser   | Native (apt/deb)                                    | Flatpak                                                              | Snap                                                              |\n|-----------|-----------------------------------------------------|----------------------------------------------------------------------|-------------------------------------------------------------------|\n| Brave     | `~/.config/BraveSoftware/Brave-Browser/`            | `~/.var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser/`   | `~/snap/brave/current/.config/BraveSoftware/Brave-Browser/`       |\n| Chrome    | `~/.config/google-chrome/`                          | `~/.var/app/com.google.Chrome/config/google-chrome/`                 | `~/snap/google-chrome/current/.config/google-chrome/`             |\n| Chromium  | `~/.config/chromium/`                               | `~/.var/app/org.chromium.Chromium/config/chromium/`                  | `~/snap/chromium/current/.config/chromium/`                       |\n| Edge      | `~/.config/microsoft-edge/`                         | `~/.var/app/com.microsoft.Edge/config/microsoft-edge/`               | `~/snap/microsoft-edge/current/.config/microsoft-edge/`           |\n| Opera     | `~/.config/opera/`                                  | `~/.var/app/com.opera.Opera/config/opera/`                           | `~/snap/opera/current/.config/opera/`                             |\n| Firefox   | `~/.mozilla/firefox/`                               | `~/.var/app/org.mozilla.firefox/.mozilla/firefox/`                   | `~/snap/firefox/common/.mozilla/firefox/`                         |\n\n#### Windows\n\n| Browser   | Path                                                                  |\n|-----------|-----------------------------------------------------------------------|\n| Brave     | `%LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data`               |\n| Chrome    | `%LOCALAPPDATA%\\Google\\Chrome\\User Data`                             |\n| Chromium  | `%LOCALAPPDATA%\\Chromium\\User Data`                                  |\n| Edge      | `%LOCALAPPDATA%\\Microsoft\\Edge\\User Data`                            |\n| Opera     | `%APPDATA%\\Opera Software\\Opera Stable`                              |\n| Firefox   | `%APPDATA%\\Mozilla\\Firefox\\Profiles`                                 |\n\nAll profile directories (Default, Profile 1, Profile 2, etc.) are detected automatically.\n\n## Download\n\nDownload the latest release from the [releases page](https://github.com/codyjdalton/browser-analyzer/releases/):\n\n- **Windows** — download the `.exe` portable executable\n- **Linux** — download the `.AppImage` portable executable\n\nNo installation required for either platform — just download and run.\n\n## Building from Source\n\n### Prerequisites\n\n- Node.js 18+ and npm\n- Linux (tested on Ubuntu 24.04+) or Windows 10+\n\n### Setup\n\n```bash\ngit clone \u003crepository-url\u003e\ncd browser-analysis\nnpm install\nnpx electron-rebuild\n```\n\n### Development\n\n```bash\nnpm start\n```\n\n### Build AppImage (Linux)\n\n```bash\nnpm run dist\n```\n\nThe AppImage is output to `dist/Browser History Analyzer-1.0.0.AppImage`.\n\n### Build Portable EXE (Windows)\n\nFrom a Linux host (cross-compile):\n\n```bash\nnpm run dist:win\n```\n\nThis fetches the Windows `better-sqlite3` native binary, then builds a portable `.exe` via electron-builder. The EXE is output to the `dist/` directory.\n\n### Using the Application\n\n1. **Select a time range** — defaults to the past year, or check \"From the beginning of time\"\n2. **Choose a data source**:\n   - **Local Browsers** — automatically discovers installed browser profiles on the current machine\n   - **Upload Files** — manually select History and/or Bookmarks files from disk (e.g. files copied from another computer or a forensic image). Pick a browser type, then use the file pickers to load a History database (`History` for Chromium-based, `places.sqlite` for Firefox) and optionally a Bookmarks JSON file.\n3. **Click \"Load History\"** — loads URLs, searches, and bookmarks from all selected profiles or uploaded files\n4. **Browse tabs**:\n   - **URLs** — Full browsing history with visit counts, durations, referrers, and transition types\n   - **Searches** — Extracted search queries with the search engine identified\n   - **Bookmarks** — All bookmarks with folder paths\n5. **Use filters** (URLs tab only):\n   - **Suspicious Activity** — Show only flagged records (enabled after background analysis completes)\n   - **Filter Duplicates** — Group by URL, sum durations, show first/last visit\n   - **Search box** — Filter by URL or title text\n6. **Export** — Click \"Export CSV\" to save the current tab's data\n\n## Architecture\n\n```\nbrowser-analysis/\n├── main.js                  # Electron main process, IPC handlers\n├── preload.js               # Context bridge (secure API exposure)\n├── src/\n│   ├── db.js                # SQLite queries (history + search terms + profanity flagging)\n│   ├── bookmarks.js         # Chromium Bookmarks JSON parser\n│   ├── profiles.js          # Browser profile discovery (native/Flatpak/Snap)\n│   ├── utils.js             # Chrome timestamp conversion, transition decoding, search URL parsing\n│   └── csv-export.js        # RFC 4180 CSV generation\n├── renderer/\n│   ├── index.html           # Application shell with tab layout\n│   ├── styles.css           # Light forensics theme\n│   └── renderer.js          # UI logic, generic tab system, pagination, sorting, filters\n├── build/\n│   └── icons/               # App icons (16-256px) for electron-builder\n├── AppIcon.png              # Application icon\n└── package.json             # Dependencies and electron-builder config\n```\n\n### Data Flow\n\n1. **Profile discovery** (`profiles.js`) — scans filesystem for browser data directories\n2. **Database access** (`db.js`) — copies SQLite History file to temp (avoids browser lock), queries `visits` + `urls` tables, cleans up\n3. **Search extraction** (`db.js` + `utils.js`) — queries `keyword_search_terms` table + parses search engine URLs from history\n4. **Bookmark parsing** (`bookmarks.js`) — reads Chromium `Bookmarks` JSON, recursively flattens folder tree\n5. **Profanity analysis** (`db.js`) — runs asynchronously after load, uses `bad-words` npm package + 90+ custom forensic keywords via compiled regex\n6. **Rendering** (`renderer.js`) — generic tab system with independent sorting/pagination per tab\n\n### IPC Channels\n\n| Channel          | Direction       | Purpose                                              |\n|------------------|-----------------|------------------------------------------------------|\n| `get-profiles`   | renderer → main | Discover available browser profiles                  |\n| `load-history`   | renderer → main | Query browsing history from SQLite                   |\n| `load-searches`  | renderer → main | Extract search terms (DB + URL patterns)             |\n| `load-bookmarks` | renderer → main | Parse bookmark JSON files                            |\n| `flag-rows`      | renderer → main | Run profanity/suspicious content analysis            |\n| `export-csv`     | renderer → main | Generate CSV file via save dialog                    |\n\n## Technical Details\n\n### Chrome Timestamps\n\nChromium-based browsers store timestamps as microseconds since January 1, 1601 (Windows NT epoch). Conversion to Unix epoch:\n\n```\nunix_seconds = (chrome_timestamp - 11644473600000000) / 1000000\n```\n\n### History Database Schema\n\nThe app queries two primary tables:\n\n- **`urls`** — `id`, `url`, `title`, `visit_count`, `typed_count`, `last_visit_time`, `hidden`\n- **`visits`** — `id`, `url` (FK to urls.id), `visit_time`, `from_visit`, `transition`, `visit_duration`\n- **`keyword_search_terms`** — `keyword_id`, `url_id` (FK to urls.id), `term`, `normalized_term`\n\nThe `transition` field is a bitmask. Core types (lower 8 bits): LINK (0), TYPED (1), AUTO_BOOKMARK (2), AUTO_SUBFRAME (3), MANUAL_SUBFRAME (4), GENERATED (5), AUTO_TOPLEVEL (6), FORM_SUBMIT (7), RELOAD (8), KEYWORD (9), KEYWORD_GENERATED (10).\n\n### Bookmarks JSON Format\n\nChromium stores bookmarks in a JSON file with this structure:\n\n```json\n{\n  \"roots\": {\n    \"bookmark_bar\": { \"children\": [...], \"name\": \"Bookmarks bar\" },\n    \"other\": { \"children\": [...], \"name\": \"Other bookmarks\" },\n    \"synced\": { \"children\": [...], \"name\": \"Mobile bookmarks\" }\n  }\n}\n```\n\nEach bookmark: `{ \"name\": \"...\", \"url\": \"...\", \"type\": \"url\", \"date_added\": \"13411...\" }`\nEach folder: `{ \"name\": \"...\", \"type\": \"folder\", \"children\": [...] }`\n\n### Suspicious Activity Detection\n\nThe app combines the `bad-words` npm package word list with 90+ custom forensic indicators across categories:\n\n- Data exfiltration (pastebin, file sharing, anonymous uploads)\n- Privacy/anonymization tools (Tor, VPNs, disposable email)\n- Hacking tools and forums (exploit-db, metasploit, keyloggers)\n- Credential theft (stealer, darkweb, bitcoin mixers)\n- Social engineering (phishing, pretexting)\n- Insider threat indicators (job searches, data theft, evidence destruction)\n- Malware (ransomware, trojan, sandbox evasion)\n\nDetection runs asynchronously after data loads so the UI remains responsive.\n\nsee SUSPICIOUS_ACTIVITY.md\n\n### History Retention\n\nChromium-based browsers automatically purge history older than 90 days. This is a browser limitation, not a tool limitation.\n\n## Dependencies\n\n- **better-sqlite3** — Synchronous SQLite3 bindings for reading browser history databases\n- **bad-words** — Profanity word list for suspicious content detection\n- **electron** — Desktop application framework\n- **electron-builder** — AppImage packaging\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcodyjdalton%2Fbrowser-analyzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcodyjdalton%2Fbrowser-analyzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcodyjdalton%2Fbrowser-analyzer/lists"}