Sherlock Forensics Browser Viewer

Browser forensics extracts and analyzes browsing artifacts as digital evidence. The discipline matters across HR investigation browser reviews, civil litigation e-discovery, regulated-industry compliance audits, child internet monitoring and internal misconduct investigations. Sherlock Forensics Browser Viewer is built for the practical end of browser forensics: read-only extraction of browser history, bookmarks, downloads and extensions across 8 browsers, with optional CSV export for forensic reports and legal filings.

In an HR investigation browser review, the artifacts that matter are visited URLs (where the employee navigated), search queries (intent signals), browser timeline reconstruction (when activity occurred), downloaded files (data exfiltration evidence) and form data (account access patterns). For civil litigation e-discovery, browser history is increasingly listed in document requests alongside email and chat. For regulated industries (healthcare, finance, government), compliance auditors check browser activity against internet-usage policy. For parental monitoring, browser history reveals the platforms a child actually uses versus what they say they use.

Sherlock's read-only extraction model keeps the browser history evidence forensically sound. The Forensic Edition adds CSV export so investigators can deliver structured browser-evidence packets to HR, legal counsel or compliance officers without the back-and-forth screenshotting that wastes investigator time. Pair the tool with our browser history evidence in HR investigation guide and browser forensics extraction methodology walkthrough for the full operational playbook. See also the Browser Viewer 1.0 launch notes for the build history. For the parallel mailbox-forensics layer of HR investigations and incident response, pair Browser Viewer's browser-history extraction with Sherlock Forensics PST Viewer for the email and calendar artifact extraction from the same custodian's mailbox. To preserve chain-of-custody on the exported CSV, hash the file with Sherlock Forensics Hash Calculator at the moment of acquisition and again at the moment of delivery to legal counsel or HR; matching hashes prove the evidence has not been altered in transit.

Auto-detects every installed browser and all profiles on the system.

Each browser family stores its artifacts in a different SQLite schema. Sherlock Forensics Browser Viewer normalizes browser forensics across the Chromium and Gecko stacks so the investigator works in a single unified browser timeline rather than juggling six separate forensic tools and six different export formats.

Chrome, Edge, Brave, Opera, Opera GX, Vivaldi (Chromium family)

Chrome history is stored in the History SQLite database (urls, visits, downloads tables). Edge history uses the same Chromium-derived schema. Brave, Opera and Vivaldi inherit the chrome history format wholesale. Sherlock extracts chrome history records including visit counts, transition types and per-URL timestamps, plus the parallel edge history visits, the Brave/Opera/Vivaldi history rows, the browser cache index references, Top Sites, Login Data records, the downloads index and the Extensions registry, all enumerated per profile.

Firefox (Gecko)

Firefox history lives in places.sqlite (moz_places, moz_historyvisits, moz_bookmarks tables). Sherlock parses Firefox history alongside formhistory.sqlite, cookies.sqlite, the sessionstore.json browser session data and Firefox's separate browser cache directory. The Firefox profile model means multiple browser timelines per user, each with independent firefox history.

Tor Browser

Tor Browser is a hardened Firefox fork. Sherlock extracts the disk-persisted Tor profile including onion-site browsing history and bookmarks. Tor's default configuration discards much of the session data on exit, so Tor browser timeline reconstruction depends on how the suspect machine was configured.

Nirsoft BrowsingHistoryView is the free Windows-only browsing history view utility that has dominated the casual browser forensics space for over a decade. It's a single-purpose tool: enumerate browser history records and dump them to a list. For a casual one-off lookup of nirsoft browsing history records, the free browsing history view utility still works and we'll be the first to say so. The nirsoft browsing history workflow stops short of forensic-grade output and for evidentiary work the gaps are real.

If you need to answer "did this user visit this URL on this date" for a curiosity case, the nirsoft browsing history dump from the free browsing history view tool is fine. If you need to deliver chrome history, firefox history and edge history records as evidence in an HR investigation, an e-discovery production or a court filing, the BrowsingHistoryView output is not enough. You need a tool that runs on Windows and Linux, supports Tor Browser, normalizes records across the Chromium and Gecko families into a unified browser timeline, ships a chain of custody manifest with the Forensic Edition and exports cleanly to CSV for the evidence binder. That is what Sherlock Forensics Browser Viewer was designed to do as the Nirsoft alternative for forensic work. The full side-by-side is in our Sherlock Forensics Browser Viewer vs Nirsoft BrowsingHistoryView comparison plus the broader competitor positioning context in our Cellebrite vs Magnet AXIOM 2026 breakdown.

1. Install Sherlock Forensics Browser ViewerDownload the free installer from this page. 5.9 MB. SHA256 verified for integrity. No admin privileges required.
2. Scan Computer for BrowsersLaunch the tool and click Scan. It auto-detects every installed browser and all profiles. Databases are copied to a temp file for read-only analysis. Works while browsers are open.
3. Filter ResultsBrowse history, bookmarks, downloads and extensions across all detected browsers. Use search, sort and filter to isolate relevant artifacts by date, URL, keyword or browser.
4. Export to CSVWith the Forensic Edition ($29 USD), export any filtered tab to CSV for inclusion in forensic reports, legal filings or incident response documentation.

The two most common buyer questions on browser forensics are: can I recover deleted browser history and can I retrieve incognito history. The honest answers depend on what was deleted, how it was deleted and whether the browser had time to commit the changes to disk.

Deleted Browser History Recovery

When a user clears their chrome history, the SQLite urls and visits records are removed from the live database. To recover records that the user has explicitly deleted, the workflow is forensic carving: acquire the disk image with Sherlock Forensics Disk Imager, then mount the resulting E01 or DD image and point Browser Viewer at the mounted profile path. For deleted-record carving against the unallocated SQLite pages, the workflow chains into our forensic carving service. Sherlock Forensics Browser Viewer reads the live committed browser history databases as they exist on disk at the time of acquisition and does not perform freelist or unallocated-page carving against the SQLite files. For the carving workflow that does recover explicitly-deleted records, the right path is a forensic disk image plus the carving service.

Older deletions are harder. Once the WAL is checkpointed and the SQLite database is vacuumed, the recover browser history path requires unallocated-page carving or full-disk-image forensic carving. That is out of scope for a $29 browser viewer but it is in scope for our full forensic investigation services, where we recover browser history from disk images for civil and criminal matters.

Incognito History and Private Browsing Sessions

Chrome incognito mode, Edge InPrivate, Firefox private browsing and Brave private windows are designed to NOT persist incognito history to the local SQLite database. By design, Sherlock Forensics Browser Viewer reads the disk-persisted state and will not surface incognito history from disk alone. Incognito history is not always perfectly invisible: DNS resolver cache, OS-level prefetch artifacts, network-adapter logs, hosts-file lookups, the browser cache that sometimes leaks under crash recovery and RAM dumps (if captured at the right moment) can all expose private browsing activity. For an incognito history investigation Sherlock covers the disk-artifact side. Combine with memory forensics and network logs for a complete private browsing timeline reconstruction.