Free Download · Version 2.3.0

Sherlock Forensics Browser Viewer

Sixteen artifact categories, deleted-record recovery and pattern-of-life charting across 8 browsers. Read-only, on live or imaged systems. Built by CISSP, ISSAP, ISSMP certified examiners.

Sherlock Forensics Browser Viewer is a free Windows desktop tool that extracts sixteen artifact categories from Chrome, Edge, Firefox, Brave, Opera, Opera GX, Vivaldi and Tor: history, bookmarks, downloads, extensions, sessions, saved forms, deep storage and more. It recovers deleted history, cookies and login records from SQLite freelist pages and write-ahead logs, reads saved-credential metadata (never the password itself) and flags the storage records belonging to AI chat services. Read-only: databases are copied to a temp file and the originals are never touched. The free edition previews half the rows of every table with the hidden count shown; the Forensic Edition at $49 USD unlocks the complete data set, CSV export and a report panel.

6fc42aaf2d732008516c170152ad2a8fd3d71fdf1bacfbdaaa9eadf16517becf

How to verify:
1. Open PowerShell (right-click Start menu, click Terminal)
2. Run: Get-FileHash .\sherlock-browser-viewer.exe
3. Compare the output with the hash above. If they match, the file has not been tampered with.

New in 2.3.0

Charts and pattern of life

Every artifact tab now has a Charts view beside the table, reading the same filtered rows. Narrow to a date range or a single browser and the charts follow. 41 charts across 15 tabs.

Pattern of life

An hour-by-weekday grid of browsing activity that shows when someone was actually at the keyboard. Working hours, evenings, weekends and the gaps all read straight off it. It answers the question an examiner asks first.

AI chat service footprint

Stored records belonging to AI assistants, ranked by origin.

Timelines

History, bookmarks, downloads, saved-credential dates and form entries on an auto-scaled timeline, from days to months by the span of the data.

Volume at a glance

Top sites by visit count, download volume by source domain and cache volume by origin.

Deleted-record confidence

A breakdown that reads carved results as leads rather than findings, so nothing is overstated.

Built for colour-vision safety

The palette is validated for lightness, chroma and colour-vision separation in both light and dark themes. Every chart carries a tooltip and a legend so nothing depends on colour alone.

New in 2.2.0

Sixteen artifact categories, deleted-record recovery and deep browser storage analysis. Read-only, on live or imaged systems.

Recovered deleted records

Carves deleted history, cookies, web data and login records out of SQLite freelist pages and write-ahead logs, so activity a user cleared is not simply gone.

AI chat artifacts

Surfaces IndexedDB, local storage and session storage records, then flags the ones belonging to AI chat services automatically.

Saved-credential metadata

Reads the username, origin and the created and last-used dates for saved logins. The encrypted password itself is never read or decrypted.

Saved forms and autofill

Including stored card metadata such as expiry and cardholder name. The card number is never read.

Sixteen artifact categories

History, bookmarks, downloads and extensions, along with sessions, saved forms, tab state, deep storage, caches, per-site permissions, hardware and network cache.

Two-phase scan

Common artifacts appear in about a second while the deep byte-scanning modules keep running in the background with a live progress indicator, so you can work immediately.

Built for scale

Virtual scrolling keeps tables responsive at hundreds of thousands of rows, with sortable columns and search, date-range and per-browser filters across every tab.

Read-only

Data files are copied to a temporary location and read from the copy, so the originals are never touched and a live browser can stay open.

Forensic Context

Browser History Forensics for HR Investigations, Litigation and Compliance

Browser forensics extracts and analyzes browsing artifacts as digital evidence. The discipline matters across HR investigation browser reviews, civil litigation e-discovery, regulated-industry compliance audits, child internet monitoring and internal misconduct investigations. Sherlock Forensics Browser Viewer is built for the practical end of browser forensics: read-only extraction of browser history, bookmarks, downloads and extensions across 8 browsers, with optional CSV export for forensic reports and legal filings.

In an HR investigation browser review, the artifacts that matter are visited URLs (where the employee navigated), search queries (intent signals), browser timeline reconstruction (when activity occurred), downloaded files (data exfiltration evidence) and form data (account access patterns). For civil litigation e-discovery, browser history is increasingly listed in document requests alongside email and chat. For regulated industries (healthcare, finance, government), compliance auditors check browser activity against internet-usage policy. For parental monitoring, browser history reveals the platforms a child actually uses versus what they say they use.

Sherlock's read-only extraction model keeps the browser history evidence forensically sound. The Forensic Edition adds CSV export so investigators can deliver structured browser-evidence packets to HR, legal counsel or compliance officers without the back-and-forth screenshotting that wastes investigator time. Pair the tool with our browser history evidence in HR investigation guide and browser forensics extraction methodology walkthrough for the full operational playbook. See also the Browser Viewer 1.0 launch notes for the build history. For the parallel mailbox-forensics layer of HR investigations and incident response, pair Browser Viewer's browser-history extraction with Sherlock Forensics PST Viewer for the email and calendar artifact extraction from the same custodian's mailbox. To preserve chain-of-custody on the exported CSV, hash the file with Sherlock Forensics Hash Calculator at the moment of acquisition and again at the moment of delivery to legal counsel or HR; matching hashes prove the evidence has not been altered in transit.

Compatibility

Supported Browsers

Chrome

Edge

Firefox

Brave

Opera

Opera GX

Vivaldi

Tor

Auto-detects every installed browser and all profiles on the system.

Extraction

Artifacts Extracted

Complete browsing history from all detected browsers and profiles.

URLs: Full URL of every visited page
Page Titles: Title of each visited page as recorded by the browser
Visit Counts: Number of times each URL was visited
Timestamps: Date and time of each visit in local and UTC format

All saved bookmarks with full folder hierarchy.

Bookmark URL: The saved URL
Bookmark Title: User-assigned or page-default title
Folder Path: Full folder path showing bookmark organization (e.g. Bookmarks Bar > Work > Projects)
Date Added: When the bookmark was created

Download records from all browsers.

Source URL: The URL the file was downloaded from
Target Path: Local file path where the download was saved
File Size: Size of the downloaded file in bytes
Download State: Whether the download completed, was interrupted or was cancelled

Installed browser extensions and add-ons.

Extension Name: Display name of the installed extension
Version: Currently installed version number
Enabled State: Whether the extension is active or disabled
Install Date: When the extension was first installed

Session-scoped records from the current and previous browser sessions.

Session Cookies: Cookies scoped to the browser session rather than persisted long-term
Session Storage: Per-tab session storage records

Saved form and autofill data.

Autofill Values: Saved form field values
Autofill Profiles: Stored address and contact profiles
Card Metadata: Card expiry and cardholder name only. The card number is never read.

Tab and top-site state.

Top Sites: The browser's most-visited site list
Last Session: Reconstruction of the tabs open in the previous session

Saved-credential metadata only.

Credential Metadata: Username, origin, created and last-used dates and password length
Boundary: The encrypted password blob itself is never read or decrypted

Deep browser storage records.

Storage Records: IndexedDB, local storage and session storage records
AI Chat Flagging: Records belonging to AI chat services are flagged automatically
Scan Cap: Up to 20,000 records per profile, with the found-versus-shown count reported honestly

Deleted records carved from the browser's own SQLite files.

Carving Source: SQLite freelist pages and write-ahead logs
Record Types: Deleted history, cookies, web data and login records

Per-extension stored data, shallow scan.

Extension Storage: Per-extension stored data enumerated from a shallow scan

Per-extension stored data, deep scan.

Deep Extension Scan: Per-extension stored data from a deep byte-level scan

Cache metadata.

Cache Metadata: Cached response metadata

Per-site permissions.

Site Permissions: Per-site media and device permissions

Display and hardware state.

Display: Attached screen geometry and per-site zoom levels

Network cache and configuration.

Network Cache: Resolved DNS entries, TLS session tickets, HSTS hosts, DoH configuration and proxy configuration

Browser-Specific Extraction

What Sherlock Forensics Browser Viewer Extracts: Chrome, Firefox, Edge, Brave, Opera, Tor

Each browser family stores its artifacts in a different SQLite schema. Sherlock Forensics Browser Viewer normalizes browser forensics across the Chromium and Gecko stacks so the investigator works in a single unified browser timeline rather than juggling six separate forensic tools and six different export formats.

Chrome, Edge, Brave, Opera, Opera GX, Vivaldi (Chromium family): Chrome history is stored in the History SQLite database (urls, visits, downloads tables). Edge history uses the same Chromium-derived schema. Brave, Opera and Vivaldi inherit the chrome history format wholesale. Sherlock extracts chrome history records including visit counts, transition types and per-URL timestamps and the parallel edge history visits, the Brave/Opera/Vivaldi history rows, the browser cache index references, Top Sites, Login Data records, the downloads index and the Extensions registry, all enumerated per profile.
Firefox (Gecko): Firefox history lives in places.sqlite (moz_places, moz_historyvisits, moz_bookmarks tables). Sherlock parses Firefox history alongside formhistory.sqlite, cookies.sqlite, the sessionstore.json browser session data and Firefox's separate browser cache directory. The Firefox profile model means multiple browser timelines per user, each with independent firefox history.
Tor Browser: Tor Browser is a hardened Firefox fork. Sherlock extracts the disk-persisted Tor profile including onion-site browsing history and bookmarks. Tor's default configuration discards much of the session data on exit, so Tor browser timeline reconstruction depends on how the suspect machine was configured.

Competitor Displacement

Sherlock Forensics Browser Viewer vs Nirsoft BrowsingHistoryView

Nirsoft BrowsingHistoryView is the free Windows-only browsing history view utility that has dominated the casual browser forensics space for over a decade. It's a single-purpose tool: enumerate browser history records and dump them to a list. For a casual one-off lookup of nirsoft browsing history records, the free browsing history view utility still works and we'll be the first to say so. The nirsoft browsing history workflow stops short of forensic-grade output and for evidentiary work the gaps are real.

Capability	Nirsoft BrowsingHistoryView	Sherlock Forensics Browser Viewer
Browser support	Chromium family + Firefox + IE (legacy)	Chromium family + Firefox + Brave + Opera + Opera GX + Vivaldi + Tor
Cost	Free	Free to view, $49 CSV export
OS support	Windows only	Windows 10, 11
Forensic chain of custody	None	Yes (Forensic Edition)
Court-ready PDF report	None	Yes (Forensic Edition)
Tor Browser support	No	Yes
Extension + bookmark forensic timeline	No	Yes
Cross-browser unified browser timeline	Partial	Yes

If you need to answer "did this user visit this URL on this date" for a curiosity case, the nirsoft browsing history dump from the free browsing history view tool is fine. If you need to deliver chrome history, firefox history and edge history records as evidence in an HR investigation, an e-discovery production or a court filing, the BrowsingHistoryView output is not enough. You need a tool that runs on Windows, supports Tor Browser, normalizes records across the Chromium and Gecko families into a unified browser timeline, ships a chain of custody manifest with the Forensic Edition and exports cleanly to CSV for the evidence binder. That is what Sherlock Forensics Browser Viewer was designed to do as the Nirsoft alternative for forensic work. The full side-by-side is in our Sherlock Forensics Browser Viewer vs Nirsoft BrowsingHistoryView comparison and the broader competitor positioning context in our Cellebrite vs Magnet AXIOM 2026 breakdown.

Compare

Free vs Forensic Edition

Feature	Free	Forensic Edition ($49)
Rows shown per artifact table	Half (hidden count shown)	Complete data set
Search across all browsers	Yes	Yes
Filter by date, URL, keyword	Yes	Yes
Sort any column	Yes	Yes
Auto-detect all profiles	Yes	Yes
Read-only forensic analysis	Yes	Yes
Works while browser is open	Yes	Yes
CSV export of any filtered tab	No	Yes
Report panel (mark findings, export as one CSV)	No	Yes

Pricing

One-Time Payment. Yours Forever.

Forensic Edition

$49 USD

Single machine license. No subscription. One-time payment. Yours forever.

All free features included
CSV export of any filtered tab
Complete data set: every row of every artifact table
Report panel: mark findings across tabs, export as one CSV
Try the free version before you buy

5+ machines? Contact us for volume pricing.

Use Cases

Who Uses Sherlock Forensics Browser Viewer

Forensic Examiners

Extract browser artifacts from suspect machines during forensic investigations. Read-only analysis preserves evidence integrity. CSV export feeds directly into forensic reports and case documentation.

HR Investigations

Review employee browsing activity on corporate workstations during workplace investigations. Filter by date range or keyword. Export filtered results for HR documentation without involving IT.

Incident Response

During security incidents, extract browser history to identify malicious downloads, phishing URLs and compromised credentials. Works on live systems without disrupting the user session. See our incident response services for full investigation support.

Legal Discovery

Collect browser evidence for civil and criminal proceedings. Pairs with our expert witness services for testimony support. CSV exports provide structured data for legal review platforms.

Parental Monitoring

Review browsing history across all browsers installed on a family computer. See every profile, every browser. Free edition provides full visibility without any purchase required.

Guide

How to Extract Browser History

Install Sherlock Forensics Browser ViewerDownload the free installer from this page. 6.35 MB. SHA256 verified for integrity. No admin privileges required.
Scan Computer for BrowsersLaunch the tool and click Scan. It auto-detects every installed browser and all profiles. Databases are copied to a temp file for read-only analysis. Works while browsers are open.
Filter ResultsBrowse history, bookmarks, downloads and extensions across all detected browsers. Use search, sort and filter to isolate relevant artifacts by date, URL, keyword or browser.
Export to CSVWith the Forensic Edition ($49 USD), export any filtered tab to CSV for inclusion in forensic reports, legal filings or incident response documentation.

Recovery Reality

Can You Recover Deleted Browser History? Incognito Sessions?

The two most common buyer questions on browser forensics are: can I recover deleted browser history and can I retrieve incognito history. The honest answers depend on what was deleted, how it was deleted and whether the browser had time to commit the changes to disk.

Deleted Browser History Recovery

When a user clears their chrome history, the SQLite urls and visits records are removed from the live database. To recover records that the user has explicitly deleted, the workflow is forensic carving: acquire the disk image with Sherlock Forensics Disk Imager, then mount the resulting E01 or DD image and point Browser Viewer at the mounted profile path. For deleted-record carving against the unallocated SQLite pages, the workflow chains into our forensic carving service. Sherlock Forensics Browser Viewer 2.2.0 carves deleted records from the SQLite freelist pages and the write-ahead log, so it recovers many rows a user recently cleared, but it does not perform unallocated-page carving against the raw disk. For records lost to a full vacuum or overwritten storage, the right path is a forensic disk image and the carving service.

Older deletions are harder. Once the WAL is checkpointed and the SQLite database is vacuumed, the recover browser history path requires unallocated-page carving or full-disk-image forensic carving. That is out of scope for a $49 browser viewer but it is in scope for our full forensic investigation services, where we recover browser history from disk images for civil and criminal matters.

Incognito History and Private Browsing Sessions

Chrome incognito mode, Edge InPrivate, Firefox private browsing and Brave private windows are designed to NOT persist incognito history to the local SQLite database. By design, Sherlock Forensics Browser Viewer reads the disk-persisted state and will not surface incognito history from disk alone. Incognito history is not always perfectly invisible: DNS resolver cache, OS-level prefetch artifacts, network-adapter logs, hosts-file lookups, the browser cache that sometimes leaks under crash recovery and RAM dumps (if captured at the right moment) can all expose private browsing activity. For an incognito history investigation Sherlock covers the disk-artifact side. Combine with memory forensics and network logs for a complete private browsing timeline reconstruction.

Changelog

Release History

v2.3.0 (2026-08-02)

Charts view on every artifact tab, 41 charts across 15 tabs, all reading the same filtered rows.
Pattern of life. An hour-by-weekday grid that shows when someone was actually at the keyboard.
More charts: AI chat service footprint, auto-scaled timelines, top sites and volumes by origin and a deleted-record confidence breakdown that keeps carved results framed as leads.
Colour-vision-safe palette validated in both light and dark themes.

Windows binary EV code-signed (Sherlock Forensics Ltd). SHA-256: 6fc42aaf2d732008516c170152ad2a8fd3d71fdf1bacfbdaaa9eadf16517becf. 6.35 MB.

v2.2.0 (2026-08-02)

Sixteen artifact categories, up from four: history, bookmarks, downloads and extensions now join sessions, saved forms, tab state, deep browser storage, caches, per-site permissions, hardware and network cache.
Deleted-record recovery. Carves deleted history, cookies, web data and login records from SQLite freelist pages and write-ahead logs.
Saved-credential and card metadata. Reads the username, origin and the created and last-used dates for logins and the expiry and cardholder name for saved cards. The encrypted password and the card number are never read.
AI chat artifacts. Flags the IndexedDB, local storage and session storage records that belong to AI chat services.
Two-phase scan. Common artifacts appear in about a second while the deep byte-scanning modules keep running in the background.
Rebuilt on Tauri for Windows 10 and 11, with virtual scrolling that keeps tables responsive at hundreds of thousands of rows.
Free and Forensic Edition. The free edition previews half the rows of every table with the hidden count shown; the Forensic Edition at $49 unlocks the complete data set, CSV export and a findings report panel.

Windows binary EV code-signed (Sherlock Forensics Ltd). SHA-256: 1992891fbc004f3dc6986c659e976fbf3b09091344127143e454003942481510. 6.2 MB.

Questions

Browser Viewer FAQ

What browsers does Sherlock Forensics Browser Viewer support?

Sherlock Forensics Browser Viewer supports Chrome, Edge, Firefox, Brave, Opera, Opera GX, Vivaldi and Tor. It auto-detects every installed browser and all profiles on the system.

Does it work while the browser is open?

Yes. Sherlock Forensics Browser Viewer copies browser databases to a temporary file before reading them. This means it works while browsers are running and never locks or interferes with active browser sessions.

Is the analysis read-only and forensically sound?

Yes. The tool copies browser databases to a temp location and reads only from the copy. The original browser data files are never modified. This preserves forensic integrity and ensures the source evidence remains unaltered.

What artifacts does it extract?

Sixteen artifact categories: history, bookmarks, downloads, extensions, sessions, saved forms and autofill, tab state, deep browser storage, caches, per-site permissions, hardware and network cache. Saved forms include stored card metadata such as expiry and cardholder name, never the card number. Saved-credential records expose the username, origin and the created and last-used dates, never the password itself. Deep storage surfaces IndexedDB, local storage and session storage, with the AI chat service records flagged. It also recovers deleted history, cookies, web data and login records from SQLite freelist pages and write-ahead logs.

Does it extract cookies or saved passwords?

Yes, with a forensic boundary. Version 2.2.0 extracts cookies and web-data records and reads saved-credential metadata: the username, origin and the created and last-used dates. The encrypted password blob itself is never read or decrypted. Saved-card metadata such as expiry and cardholder name is read, never the card number.

Does my data stay local?

Yes. Sherlock Forensics Browser Viewer runs entirely on your local machine. No browser data is transmitted to any server. All analysis happens locally on your workstation.

What is the difference between Free and Forensic Edition?

The Free edition previews half the rows of every artifact table, with the hidden count shown. It includes search, filter and sort across all detected browsers and profiles. The Forensic Edition at $49 USD unlocks the complete data set, adds CSV export of any filtered tab and a report panel to mark findings across tabs and export them as one CSV.

Does it support Tor Browser?

Yes. Sherlock Forensics Browser Viewer detects and extracts artifacts from Tor Browser installations. This includes browsing history, bookmarks, downloads and extensions stored locally by the Tor Browser.

Does Sherlock Forensics Browser Viewer work on Linux?

No. Version 2.2.0 is a Windows 10 and 11 application. The earlier native Linux build is not compatible with the 2.2.0 rewrite and has been withdrawn. A tested Linux build may return in a future release.

What is browser forensics?

Browser forensics is the discipline of extracting and analyzing browsing artifacts (history, bookmarks, downloads, extensions, cookies, cache, session data) as digital evidence. It supports HR investigations, civil and criminal litigation e-discovery, incident response, internal investigations and compliance audits. Sherlock Forensics Browser Viewer performs read-only browser forensics across 8 browsers (Chrome, Edge, Firefox, Brave, Opera, Opera GX, Vivaldi, Tor) with optional CSV export at $49 for forensic reports.

Can I recover deleted browser history with Sherlock Forensics Browser Viewer?

Yes, within the browser's own databases. Version 2.2.0 carves deleted history, cookies, web data and login records out of the SQLite freelist pages and the write-ahead log, so activity a user recently cleared is often still recoverable. Records lost to a full database vacuum or overwritten on disk are beyond that and need unallocated-page carving against a disk image: Sherlock Forensics Disk Imager handles the acquisition and we offer the disk-image-carving service separately.

Can Sherlock Forensics Browser Viewer extract incognito browsing history?

Not from disk alone. Chrome incognito, Edge InPrivate, Firefox private browsing and Brave private windows are designed to not persist incognito history to local storage. Sherlock reads the disk-persisted state, so by design it will not surface incognito history from a normal profile read. Incognito history can sometimes be reconstructed from DNS cache, browser cache leaks under crash recovery, network logs, OS prefetch and RAM dumps. Sherlock covers the disk side; pair with memory forensics for the full private browsing timeline.

How is Sherlock Forensics Browser Viewer different from Nirsoft BrowsingHistoryView?

Nirsoft BrowsingHistoryView is the long-standing free Windows-only browsing history view utility. It enumerates browser history records but offers no chain of custody manifest, no Tor Browser support, no deleted-record recovery and no unified browser timeline across the Chromium and Gecko families. Sherlock Forensics Browser Viewer is the Nirsoft alternative built for forensic-grade work: sixteen artifact categories, deleted-record recovery from SQLite freelist and WAL, Tor Browser support, chain of custody manifest in the Forensic Edition, unified cross-browser timeline normalization and the full $49 CSV export pipeline for legal evidence.

What browser data can be used as evidence in HR investigations?

In an HR investigation browser review, the high-signal artifacts are visited URLs, search queries, downloaded files, browser session data, form-fill records and the browser timeline reconstruction. Visited URLs prove navigation, search queries reveal intent, downloads document data exfiltration, the browser timeline anchors when activity occurred. Sherlock Forensics Browser Viewer extracts all of these read-only and exports them via the Forensic Edition CSV. The full operational playbook is in our browser history evidence in HR investigation guide.

Does Sherlock Forensics Browser Viewer work on Mac or Linux?

Version 2.2.0 ships as a Windows x64 native binary for Windows 10 and 11. macOS and Linux are not currently supported. For macOS or Linux browser forensics today, the Sherlock workflow is to acquire the browser profiles via a forensic disk image and analyze them on a Windows machine.

Can I extract browser history from a forensic disk image?

Yes, indirectly. Sherlock Forensics Browser Viewer reads from a live filesystem path, so the standard workflow is to mount the forensic disk image read-only (using OSFMount, FTK Imager, Linux losetup or similar) and point Sherlock at the mounted profile path. The tool then enumerates chrome history, firefox history, edge history, bookmarks, downloads and extensions exactly as it would on a live system, with the disk image acting as the read-only source.

How long does Chrome, Firefox or Edge keep deleted browsing history?

Once a user clicks "Clear browsing data" the live records are removed from the SQLite urls and visits tables. After that point the records sit as unallocated SQLite pages until the database is vacuumed or the underlying storage is overwritten. The retention window is not deterministic and varies by browser-version, configured profile size and user activity since the deletion. Sherlock Forensics Browser Viewer 2.2.0 carves deleted rows from the SQLite freelist pages and the write-ahead log, recovering many recently-deleted records before a vacuum. Records lost to a full vacuum or overwritten on disk need unallocated-page carving against a forensic disk image and the carving service.

Related Sherlock Tool

Sherlock Forensics iPhone and iPad Analyzer at $599 one-time handles iOS logical acquisition alongside the sibling Sherlock tools. Logical MobileBackup2 acquisition with RFC 3394 keybag decryption, iMessage and SMS chat.db reconstruction with attribution timeline, WhatsApp and Signal conversations, photo library with EXIF and geotag artifacts, browser history and application data. Windows 10/11. Court-ready chain of custody documentation.

See Sherlock Forensics iPhone and iPad Analyzer

Get Started

Download Sherlock Forensics Browser Viewer Today

Free for viewing, searching, filtering and sorting browser data from 8 browsers. Forensic Edition at $49 USD for CSV export. Built by the same team that delivers expert witness testimony and forensic investigations in Canadian courts. See also: forensic tool suite, chain of custody software and private investigator forensic tools.

Since 2006CISSP, ISSAP, ISSMP certified888.883.4550

Sherlock Forensics Browser Viewer is provided for lawful use. Terms of Service