Sherlock Forensics Browser Viewer

Browser forensics extracts and analyzes browsing artifacts as digital evidence. The discipline matters across HR investigation browser reviews, civil litigation e-discovery, regulated-industry compliance audits, child internet monitoring and internal misconduct investigations. Sherlock Forensics Browser Viewer is built for the practical end of browser forensics: read-only extraction of browser history, bookmarks, downloads and extensions across 8 browsers, with optional CSV export for forensic reports and legal filings.

In an HR investigation browser review, the artifacts that matter are visited URLs (where the employee navigated), search queries (intent signals), browser timeline reconstruction (when activity occurred), downloaded files (data exfiltration evidence) and form data (account access patterns). For civil litigation e-discovery, browser history is increasingly listed in document requests alongside email and chat. For regulated industries (healthcare, finance, government), compliance auditors check browser activity against internet-usage policy. For parental monitoring, browser history reveals the platforms a child actually uses versus what they say they use.

Sherlock's read-only extraction model keeps the browser history evidence forensically sound. The Forensic Edition adds CSV export so investigators can deliver structured browser-evidence packets to HR, legal counsel or compliance officers without the back-and-forth screenshotting that wastes investigator time. Pair the tool with our browser history evidence in HR investigation guide and browser forensics extraction methodology walkthrough for the full operational playbook. See also the Browser Viewer 1.0 launch notes for the build history.

Auto-detects every installed browser and all profiles on the system.

Each browser family stores its artifacts in a different SQLite schema. Sherlock Browser Viewer normalizes browser forensics across the Chromium and Gecko stacks so the investigator works in a single unified browser timeline rather than juggling six separate forensic tools and six different export formats.

Chrome, Edge, Brave, Opera, Opera GX, Vivaldi (Chromium family)

Chrome history is stored in the History SQLite database (urls, visits, downloads tables). Edge history uses the same Chromium-derived schema. Brave, Opera and Vivaldi inherit the chrome history format wholesale. Sherlock extracts chrome history records including visit counts, transition types and per-URL timestamps, plus the parallel edge history visits, the Brave/Opera/Vivaldi history rows, the browser cache index references, Top Sites, Login Data records, the downloads index and the Extensions registry, all enumerated per profile.

Firefox (Gecko)

Firefox history lives in places.sqlite (moz_places, moz_historyvisits, moz_bookmarks tables). Sherlock parses Firefox history alongside formhistory.sqlite, cookies.sqlite, the sessionstore.json browser session data and Firefox's separate browser cache directory. The Firefox profile model means multiple browser timelines per user, each with independent firefox history.

Tor Browser

Tor Browser is a hardened Firefox fork. Sherlock extracts the disk-persisted Tor profile including onion-site browsing history and bookmarks. Tor's default configuration discards much of the session data on exit, so Tor browser timeline reconstruction depends on how the suspect machine was configured.

Nirsoft BrowsingHistoryView is the free Windows-only browsing history view utility that has dominated the casual browser forensics space for over a decade. It's a single-purpose tool: enumerate browser history records and dump them to a list. For a casual one-off lookup of nirsoft browsing history records, the free browsing history view utility still works and we'll be the first to say so. The nirsoft browsing history workflow stops short of forensic-grade output, and for evidentiary work the gaps are real.

If you need to answer "did this user visit this URL on this date" for a curiosity case, the nirsoft browsing history dump from the free browsing history view tool is fine. If you need to deliver chrome history, firefox history and edge history records as evidence in an HR investigation, an e-discovery production or a court filing, the BrowsingHistoryView output is not enough. You need a tool that reads the WAL for deleted browser history, normalizes browser cache references and produces a unified browser timeline. That is what Sherlock Browser Viewer was designed to do as the Nirsoft alternative for forensic work. The full side-by-side is in our Sherlock Browser Viewer vs Nirsoft BrowsingHistoryView comparison, and the broader competitor positioning context is in our Cellebrite vs Magnet AXIOM 2026 breakdown.

1. Install Sherlock Forensics Browser ViewerDownload the free installer from this page. 5.9 MB. SHA256 verified for integrity. No admin privileges required.
2. Scan Computer for BrowsersLaunch the tool and click Scan. It auto-detects every installed browser and all profiles. Databases are copied to a temp file for read-only analysis. Works while browsers are open.
3. Filter ResultsBrowse history, bookmarks, downloads and extensions across all detected browsers. Use search, sort and filter to isolate relevant artifacts by date, URL, keyword or browser.
4. Export to CSVWith the Forensic Edition ($29 USD), export any filtered tab to CSV for inclusion in forensic reports, legal filings or incident response documentation.

The two most common buyer questions on browser forensics are: can I recover deleted browser history, and can I retrieve incognito history. The honest answers depend on what was deleted, how it was deleted and whether the browser had time to commit the changes to disk.

Deleted Browser History Recovery

When a user clears their chrome history, the SQLite urls and visits records are removed from the live database. SQLite uses a write-ahead-log (WAL) journal, and on Chromium-family browsers the WAL is not always checkpointed immediately. If you acquire the profile before the WAL is flushed, the deleted browser history records often remain in the WAL journal and can be recovered. Sherlock Browser Viewer reads the WAL alongside the main database, so when you recover browser history from a freshly-cleared profile, you get the records the live application no longer displays. The same approach applies to deleted browser history on Firefox places.sqlite and on Edge.

Older deletions are harder. Once the WAL is checkpointed and the SQLite database is vacuumed, the recover browser history path requires unallocated-page carving or full-disk-image forensic carving. That is out of scope for a $29 browser viewer but it is in scope for our full forensic investigation services, where we recover browser history from disk images for civil and criminal matters.

Incognito History and Private Browsing Sessions

Chrome incognito mode, Edge InPrivate, Firefox private browsing and Brave private windows are designed to NOT persist incognito history to the local SQLite database. By design, Sherlock Browser Viewer reads the disk-persisted state and will not surface incognito history from disk alone. Incognito history is not always perfectly invisible: DNS resolver cache, OS-level prefetch artifacts, network-adapter logs, hosts-file lookups, the browser cache that sometimes leaks under crash recovery, and RAM dumps (if captured at the right moment) can all expose private browsing activity. For an incognito history investigation Sherlock covers the disk-artifact side. Combine with memory forensics and network logs for a complete private browsing timeline reconstruction.