The roots of the Mozilla Firefox browser can be traced back to 1998. Netscape Communications (formerly Netscape Communications Corporation, commonly known as Netscape) created the Mozilla Organization with the goal of developing what it called the Mozilla Application Suite. This coincided with their release of the source code for the Netscape browser which was intended to stimulate programmers to further develop the browser market. Netscape originally coined the name Mozilla for its open-source software project which was to create Netscape’s next-generation Internet suite. Later they used it in reference to their open source initiatives and as a codename for the Netscape Navigator Web browser. In 2003 AOL, which was Netscape’s parent organization, curtailed their involvement in the Mozilla Organization. Subsequently, with AOL’s assistance, the Mozilla Foundation was founded to ensure that Mozilla could survive without Netscape. Its subsidiary, the Mozilla Corporation, was established to coordinate the development and release of the Mozilla Firefox browser and the Mozilla Thunderbird e-mail client.

The primary intent of the release of Netscape’s source code was to stimulate programmers to enhance its next version. However, the result was that programmers began to develop additional browsers and development tools which then led to other projects. After several years in development in the open source environment, Mozilla 1.0 was released in 2002. The actual project which later became Firefox began as an experimental offshoot of the Mozilla browser. It was initially named Phoenix but due to a trademark conflict with Phoenix Technologies it was renamed Firebird in 2003. However the name change caused concern and conflict within the already existing open-source Firebird SQL Relational Database Management System community. Internet search engines and many users could easily be confused by both a browser and a database having the same name. To avoid further conflicts, it was renamed Mozilla Firefox (or Firefox for short) in 2004.

Early Versions of Firefox
With its name finally established, Firefox 0.8 was released in 2004. It included a Windows installer and featured offline browsing. Further versions reduced security issues, enhanced import functionality from Internet Explorer, and added search engine choices to the search bar features and RSS capability to the Bookmarks. The official launch of Firefox 1.0 occurred in late 2004. Within a year it had been downloaded more than one hundred million times! Firefox 1.5 became available for downloading late in 2005. Some improvements included an updated Options Window and a Mac-like options interface which included a “Sanitize Settings” action that allowed users to easily clear privacy related information by using a short-cut key or by just closing Firefox. Version was the final version supported on Windows 95. In the later part of 2006, Firefox 2.0 was released. Among other features, this version included enhanced RSS capabilities, anti-phishing protection, inline spell checking, improved tabbed browsing, and Session Restore. Firefox was the final version supported on Windows NT 4.0, Windows 98, and Windows Me.

Firefox 3 was released in the summer of 2008 and included new features such as a “Places” system for storing bookmarks, separate themes for different operating systems, and a redesigned download manager. Several major version and sub-version updates included Version 3.5 (Summer 2009: enhanced performance, use of the Gecko 1.9.1 engine, updated logo, etc.) and Version 3.6 (early 2010: used the Gecko 1.9.2 engine, ran plugins in separate processes, etc.). Various Alpha versions of Firefox 3.7 were released during the first half of 2010. In the summer of that year, the version number was changed to Firefox 4.0 and the final version was released in the spring of 2011. Some of the major improvements included use of the Gecko 2.0 engine, a new user interface, and improved notifications. Starting in 2011, Mozilla committed to a rapid development of future versions of Firefox. They began to split the development process into several channels which they termed “Beta,” “Aurora,” and “Nightly.” This allowed developers to work on different builds that were in different development stages. The goal was to quickly provide new features to users with new releases occurring every six weeks or so. Since then, there have been releases of Firefox 5 through Firefox 14 (as of this writing). Versions 15, 16, and 17 are already planned for release in the latter part of 2012.


Forensic Overview
From a forensic perspective, at first glance the many versions of Firefox seem to present a difficult technical challenge. Not surprisingly, many of the artifacts of forensic interest have (and probably will) continue to change with each release. With all the different versions available, it is almost certain that a forensic examiner will encounter several as they examine computer hard drives for probative browser information. A question to be considered is whether or not the forensic examiner has to be an expert on each version of Firefox. This would indeed be a daunting task! However, throughout the version changes, there remain several constants that make this task somewhat easier. The majority of the forensic information pertaining to the different versions of Firefox does not reside in the Windows Registry but rather in two directories located in the individual user account(s). Those two directories are as follows:

• Windows XP:

o C:\Documents and Settings\[User]\Application Data\Mozilla\ Firefox\Profiles\xxxxxxxx.default\
o C:\Documents and Settingd\[user]\Local Settings\Application Data\ Firefox\Profiles\xxxxxxxx.default\Cache\

• Windows Vista, Windows 7, and Windows 8:

o C:\Users\[User]\AppData]Local\Mozilla\Firefox\Profiles\xxxxxxxx.default\Cache\
o C:\Users\[User]\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default\

For Linux and Mac based systems, the default locations are as follows:

• Linux:

o ~/.mozilla/firefox/xxxxxxxx.default/

• Mac OS X:

o ~/Library/Application Support/Firefox/Profiles/xxxxxxxx.default/
o ~/Library/Application Support/Mozilla/Extensions
o ~/Library/Caches/Firefox/Profiles/xxxxxxxx.default/Cache/

This is part one of a series on Mozilla Firefox Forensics.

John J. Barbara owns Digital Forensics Consulting, LLC, providing consulting services for companies and laboratories seeking digital forensics accreditation. An ASCLD/LAB inspector since 1993, John has conducted inspections in several forensic disciplines including Digital Evidence. John is the General Editor for the “Handbook of Digital & Multimedia Forensic Evidence” published by Humana Press. He can be reached at