Profile: modules/browser/firefox.toml

• Source
• Profile (TOML)

Source

• Original path: profiles/modules/browser/firefox.toml

Profile (TOML)

# Firefox Browser Artifacts Module
# Collects Mozilla Firefox browser artifacts

[module]
name = "Firefox Browser Artifacts"
description = "Firefox history, cookies, bookmarks, and downloads"
category = "browser"
platform = ["windows", "linux", "macos"]
priority = "high"

decode = ["base64", "percent-encoding"]

# Firefox Places (history and bookmarks)
[[patterns]]
  name = "Firefox Places Database"
  pattern = "places\\.sqlite"
  case-insensitive = true
  type = "regex"

# Firefox Cookies
[[patterns]]
  name = "Firefox Cookies"
  pattern = "cookies\\.sqlite"
  case-insensitive = true
  type = "regex"

# Firefox Downloads
[[patterns]]
  name = "Firefox Downloads"
  pattern = "downloads\\.sqlite"
  case-insensitive = true
  type = "regex"

# Firefox Logins (saved passwords)
[[patterns]]
  name = "Firefox Logins"
  pattern = "logins\\.json"
  case-insensitive = true
  type = "regex"

# Firefox Form History
[[patterns]]
  name = "Firefox Form History"
  pattern = "formhistory\\.sqlite"
  case-insensitive = true
  type = "regex"

# Firefox Cache
[[patterns]]
  name = "Firefox Cache"
  pattern = "Firefox.*[Cc]ache"
  case-insensitive = true
  type = "regex"

# Firefox Bookmarks Backup
[[patterns]]
  name = "Firefox Bookmarks Backup"
  pattern = "bookmarkbackups"
  case-insensitive = true
  type = "regex"

# Firefox Session Store
[[patterns]]
  name = "Firefox Session Store"
  pattern = "sessionstore\\.(?:js|jsonlz4)"
  case-insensitive = true
  type = "regex"

# Firefox Extensions
[[patterns]]
  name = "Firefox Extensions"
  pattern = "extensions\\.(?:json|sqlite)"
  case-insensitive = true
  type = "regex"

# Firefox Preferences
[[patterns]]
  name = "Firefox Preferences"
  pattern = "prefs\\.js"
  case-insensitive = true
  type = "regex"