Security Research 6 min read

Browser Cache Forensics After Clear All History: What Is Actually Recoverable

browser forensics Clear All History Security Research

Clear All History deletes the primary browser history database but leaves a long list of secondary artifacts that forensic examiners routinely recover. SQLite Write-Ahead Log files, Windows prefetch entries, DNS resolver cache, registry hives plus the underlying free-space sectors all retain navigation evidence after the user clicks the delete button. This Sherlock Forensics analysis walks through the survival pattern across Chrome, Edge, Firefox, Safari plus Tor.

TL;DR: Clear All History is a primary-database wipe, not a full data destruction. SQLite WAL files, prefetch entries, DNS cache, registry plus disk slack space all retain evidence. A trained forensic examiner using Sherlock Browser Viewer Forensic Edition typically reconstructs 60 to 80 percent of the cleared timeline.

What Clear All History Does

Each browser implements the Clear All History action slightly differently, but all five major browser families (Chrome, Edge, Firefox, Safari, Tor) follow the same broad pattern. The browser executes a SQL DELETE plus VACUUM cycle against the History database, deletes the Cache directory contents, clears Cookies plus zeroes the autofill table. The user-visible artifacts disappear immediately.

What does NOT happen is a forensic-grade wipe of the underlying disk sectors. The deleted rows are removed from the SQLite database index but the bytes that contained them often persist in the SQLite Write-Ahead Log (WAL) file or in pages flagged as free but not zeroed. The Cache directory entries are unlinked from the filesystem but the file content survives on disk until the sectors are overwritten by new writes. Cookies plus autofill follow the same pattern.

The Surviving Artifacts (Per Browser Family)

Chrome (and Edge as Chromium derivatives). The primary History database is at %LOCALAPPDATA%\Google\Chrome\User Data\Default\History. Clear All History wipes the visits plus urls tables. The History-journal plus History-wal files often retain pre-delete state for hours after the action. The Top Sites database persists. The Network Action Predictor (autocomplete prediction) database persists. The Local State JSON file plus the Service Workers cache directory both retain navigation hints. Chrome-derived browsers like Edge plus Brave plus Opera all share this structure.

Firefox. The primary History database is the places.sqlite file. Clear All History wipes the moz_historyvisits plus moz_places tables. The places.sqlite-wal file often retains pre-delete state until the database is reopened plus checkpointed. Form history plus search engine history are stored in separate databases (formhistory.sqlite, search.json.mozlz4) that have their own clear-history paths.

Safari. The primary History database is ~/Library/Safari/History.db on macOS. Safari uses CoreData for the history schema rather than direct SQLite. The CoreData WAL plus shm files persist, plus the iCloud Tabs database (TabSnapshots/TabSnapshots.db) retains tab session evidence even after Clear All History.

Tor Browser. Tor inherits Firefox's profile model but configures the browser to operate in private-by-default mode. The History database typically is not written to disk during normal use. Forensic recovery from Tor focuses on the Tor data directory (state files, control-port history) plus the Memory Cache plus the underlying disk slack from any session that pre-dated the private-mode configuration.

The Non-Browser Artifacts (Often Overlooked)

Beyond the browser-specific recovery surfaces, every browser session writes evidence to system-level locations that the Clear All History action does not touch.

  • Windows Prefetch. Each browser executable produces a Prefetch file at C:\Windows\Prefetch\ with the executable name plus a hash suffix. Prefetch files record the last 8 execution times for the binary. Clear All History does not wipe Prefetch.
  • DNS resolver cache. Every browser navigation triggers a DNS resolution. The Windows DNS Client Service (Dnscache) caches the resolution result in memory. The cache survives until the service restarts or the entry TTL expires. Examiners pull ipconfig /displaydns output as part of forensic acquisition.
  • Windows registry MRU keys. The TypedURLs key under HKCU\Software\Microsoft\Internet Explorer\ retains typed URLs for IE-derived navigation; the equivalent key for Edge is under HKCU\Software\Microsoft\Edge\. Internet Explorer is end-of-life but the registry keys persist on systems that have ever run it.
  • SQLite slack space. SQLite databases use a page-based storage model with free-page management. After a DELETE plus VACUUM the database file size may shrink, but the bytes from the deleted pages often persist in disk sectors until overwritten. Sherlock Browser Viewer's slack-space carving recovers fragments of cleared records.
  • Browser extension state. Many extensions maintain their own state databases that the Clear All History action does not touch. Password managers, ad blockers, productivity extensions plus theme extensions often retain navigation context evidence.

The Practical Reconstruction Estimate

A trained forensic examiner running the Sherlock Browser Viewer Forensic Edition against a workstation where Clear All History was run within the last 48 hours typically reconstructs between 60 and 80 percent of the cleared navigation timeline. The recovery percentage depends on three factors: how long ago the action was performed (longer windows allow more sector overwrite), how active the browser was after the action (more writes overwrite more sectors) plus which browser was used (Chrome plus Firefox leave more recovery surfaces than Safari plus Tor).

For the user who believes Clear All History provides a clean slate: it does not. For the investigator who needs to reconstruct browsing activity after a user attempted to cover tracks: the recovery is usually feasible. Browser Viewer Forensic Edition at \$29 USD lifetime is the tool that runs this reconstruction across all five browser families in a single scan.

What Browser Viewer Actually Does

Browser Viewer Forensic Edition opens browser profile directories without a running browser instance. It parses the primary databases (History, Cookies, Autofill, Bookmarks, Downloads, Top Sites) plus the WAL plus shm sidecars plus the Cache plus the Extensions state. It surfaces recoverable artifacts even after Clear All History was run. The Forensic Edition output is a court-ready PDF report documenting per-artifact recovery confidence plus the SHA-256 hash of every preserved artifact for chain-of-custody compliance.