Security Research 6 min read

Browser Cache Forensics After Clear All History: What Is Actually Recoverable

browser forensics Clear All History Security Research

Clear All History deletes the primary browser history database but leaves a long list of secondary artifacts that forensic examiners routinely recover. SQLite Write-Ahead Log files, Windows prefetch entries, DNS resolver cache, registry hives and the underlying free-space sectors all retain navigation evidence after the user clicks the delete button. This Sherlock Forensics analysis walks through the survival pattern across Chrome, Edge, Firefox, Safari and Tor.

TL;DR: Clear All History is a primary-database wipe, not a full data destruction. SQLite WAL files, prefetch entries, DNS cache, registry and disk slack space all retain evidence. A trained forensic examiner using Sherlock Browser Viewer Forensic Edition typically reconstructs 60 to 80 percent of the cleared timeline.

What Clear All History Does

Each browser implements the Clear All History action slightly differently, but all five major browser families (Chrome, Edge, Firefox, Safari, Tor) follow the same broad pattern. The browser executes a SQL DELETE and VACUUM cycle against the History database, deletes the Cache directory contents, clears Cookies and zeroes the autofill table. The user-visible artifacts disappear immediately.

What does NOT happen is a forensic-grade wipe of the underlying disk sectors. The deleted rows are removed from the SQLite database index but the bytes that contained them often persist in the SQLite Write-Ahead Log (WAL) file or in pages flagged as free but not zeroed. The Cache directory entries are unlinked from the filesystem but the file content survives on disk until the sectors are overwritten by new writes. Cookies and autofill follow the same pattern.

The Surviving Artifacts (Per Browser Family)

Chrome (and Edge as Chromium derivatives). The primary History database is at %LOCALAPPDATA%\Google\Chrome\User Data\Default\History. Clear All History wipes the visits and urls tables. The History-journal and History-wal files often retain pre-delete state for hours after the action. The Top Sites database persists. The Network Action Predictor (autocomplete prediction) database persists. The Local State JSON file and the Service Workers cache directory both retain navigation hints. Chrome-derived browsers like Edge and Brave and Opera all share this structure.

Firefox. The primary History database is the places.sqlite file. Clear All History wipes the moz_historyvisits and moz_places tables. The places.sqlite-wal file often retains pre-delete state until the database is reopened and checkpointed. Form history and search engine history are stored in separate databases (formhistory.sqlite, search.json.mozlz4) that have their own clear-history paths.

Safari. The primary History database is ~/Library/Safari/History.db on macOS. Safari uses CoreData for the history schema rather than direct SQLite. The CoreData WAL and shm files persist and the iCloud Tabs database (TabSnapshots/TabSnapshots.db) retains tab session evidence even after Clear All History.

Tor Browser. Tor inherits Firefox's profile model but configures the browser to operate in private-by-default mode. The History database typically is not written to disk during normal use. Forensic recovery from Tor focuses on the Tor data directory (state files, control-port history) and the Memory Cache and the underlying disk slack from any session that pre-dated the private-mode configuration.

The Non-Browser Artifacts (Often Overlooked)

Beyond the browser-specific recovery surfaces, every browser session writes evidence to system-level locations that the Clear All History action does not touch.

  • Windows Prefetch. Each browser executable produces a Prefetch file at C:\Windows\Prefetch\ with the executable name and a hash suffix. Prefetch files record the last 8 execution times for the binary. Clear All History does not wipe Prefetch.
  • DNS resolver cache. Every browser navigation triggers a DNS resolution. The Windows DNS Client Service (Dnscache) caches the resolution result in memory. The cache survives until the service restarts or the entry TTL expires. Examiners pull ipconfig /displaydns output as part of forensic acquisition.
  • Windows registry MRU keys. The TypedURLs key under HKCU\Software\Microsoft\Internet Explorer\ retains typed URLs for IE-derived navigation; the equivalent key for Edge is under HKCU\Software\Microsoft\Edge\. Internet Explorer is end-of-life but the registry keys persist on systems that have ever run it.
  • SQLite slack space. SQLite databases use a page-based storage model with free-page management. After a DELETE and VACUUM the database file size may shrink, but the bytes from the deleted pages often persist in disk sectors until overwritten. Sherlock Browser Viewer's slack-space carving recovers fragments of cleared records.
  • Browser extension state. Many extensions maintain their own state databases that the Clear All History action does not touch. Password managers, ad blockers, productivity extensions and theme extensions often retain navigation context evidence.

The Practical Reconstruction Estimate

A trained forensic examiner running the Sherlock Browser Viewer Forensic Edition against a workstation where Clear All History was run within the last 48 hours typically reconstructs between 60 and 80 percent of the cleared navigation timeline. The recovery percentage depends on three factors: how long ago the action was performed (longer windows allow more sector overwrite), how active the browser was after the action (more writes overwrite more sectors) and which browser was used (Chrome and Firefox leave more recovery surfaces than Safari and Tor).

For the user who believes Clear All History provides a clean slate: it does not. For the investigator who needs to reconstruct browsing activity after a user attempted to cover tracks: the recovery is usually feasible. Browser Viewer Forensic Edition at \$29 USD lifetime is the tool that runs this reconstruction across all five browser families in a single scan.

What Browser Viewer Actually Does

Browser Viewer Forensic Edition opens browser profile directories without a running browser instance. It parses the primary databases (History, Cookies, Autofill, Bookmarks, Downloads, Top Sites) and the WAL and shm sidecars and the Cache and the Extensions state. It surfaces recoverable artifacts even after Clear All History was run. The Forensic Edition output is a court-ready PDF report documenting per-artifact recovery confidence and the SHA-256 hash of every preserved artifact for chain-of-custody compliance.