Digital Forensics / Intermediate: artifact-specific offline analysis / Lesson 11

Interpret browser artifact models cautiously

Use invented page and visit records to distinguish stored URLs, observed visits, downloads, and user attribution.

About 5 min readContent reviewed 2026-10-28

On this page

Lesson goals

Preserve page-to-visit relationships and unresolved references.
Explain why a browser record does not alone prove a person’s deliberate action.

Identify which browser artifact is being described

A stored URL, a visit record, a bookmark, a cache object, and a download entry answer different questions. Do not collapse them into one visited-by-user category. Browser behavior, synchronization, profiles, private modes, retention, and schema versions affect what is available and what it means. Mozilla Places documentation provides one implementation reference for history and bookmarks, not a universal browser schema. This lesson uses a custom JSON-like model and opens no browser profile, history database, cookie store, or real account. It does not collect credentials or private browsing data.

Join records with explicit unresolved references

The first program links two invented visit records to a page table and retains a missing page reference as unresolved. It does not silently discard the unmatched row or invent a URL. Actual browser databases can have different schemas, timestamps, relationships, and synchronization metadata, so a real parser must be version-aware and validated on known fixtures. A page row without a matching visit in the supplied model is not proof that no visit occurred. The source may be incomplete or represent another browser behavior. Keep the join rule and population counts in the notes.

python Join a custom page/visit fixture without losing a row

pages = {1: "https://catalog.example.invalid/workshops/4"}
visits = [{"id":"v1","page":1}, {"id":"v2","page":9}]
resolved = []
unresolved = []
for visit in visits:
    if visit["page"] in pages:
        resolved.append((visit["id"], pages[visit["page"]]))
    else:
        unresolved.append(visit["id"])
assert len(resolved) == 1 and unresolved == ["v2"]
assert len(resolved) + len(unresolved) == len(visits)
print("visit joins retain the unresolved reference")

Expected output

visit joins retain the unresolved reference

The complete program joins invented in-memory structures and uses a reserved example domain. It is not a Firefox or Chromium database parser. No browser, SQL engine, profile, URL request, or account is accessed.

Parse a URL without visiting it

A URL can contain scheme, authority, path, query, and fragment with different interpretive roles. The second program extracts a path and query from a reserved synthetic URL locally. Parsing does not verify that the location existed, was reached, or displayed the expected content. Query values may be private in real material, so avoid copying them indiscriminately into broad reports. Preserve the original string and the parser’s output separately, including decoding assumptions. A normalized host or path is a derivative interpretation and should not erase meaningful source differences or become permission to follow the link.

python Inspect URL components without DNS or HTTP

from urllib.parse import urlsplit, parse_qs
raw = "https://catalog.example.invalid/workshops/4?view=public#notes"
parts = urlsplit(raw)
assert parts.scheme == "https"
assert parts.hostname == "catalog.example.invalid"
assert parts.path == "/workshops/4"
assert parse_qs(parts.query) == {"view":["public"]}
assert parts.fragment == "notes"
print("synthetic URL components parsed offline")

Expected output

synthetic URL components parsed offline

The complete program performs local string parsing only. It makes no DNS lookup or network connection and verifies no remote content. The public query marker and reserved host are deliberately synthetic.

Separate recorded navigation from human intent

A browser artifact may reflect synchronization, redirects, restored sessions, automated activity, imports, or a shared profile, depending on the implementation and context. A URL row alone does not establish which person intentionally viewed the page or read its content. A download entry also needs its documented state before a completion claim. Correlate independently sourced application or system records only within approved scope and explain dependencies. Avoid treating a recognizable title, familiar address, or nearby timestamp as proof of motive. The custom fixture contains no such identity evidence and supports no real attribution.

Report the artifact-specific supported claim

Validate the parser against known records, missing relationships, duplicate visits, time boundaries, and unsupported schema variants where applicable. Preserve unresolved rows and exact source references. Report that a supplied visit record links to a supplied page row under the chosen model, rather than claiming a human visited a live site. Real browser collection, live databases, acquisition consistency, and source authenticity remain outside these exercises. A careful report keeps browser implementation and version assumptions visible and distinguishes the locally parsed representation from the historical event it may help explain.

Common errors and fixes

A URL row is called a deliberate human visit

Why it happens: Artifact type and attribution assumptions are collapsed.
How to fix it: Identify the record type and seek independent contextual evidence.
Prevent it next time: Separate stored data, navigation, completion, and intent.

An unmatched visit is dropped from the join

Why it happens: Missing relationships are hidden.
How to fix it: Retain an unresolved row and reconcile counts.
Prevent it next time: Test orphan-reference cases with known fixtures.

A parsed URL is opened to confirm it

Why it happens: Offline analysis expands into an unapproved network action.
How to fix it: Keep parsing local and state remote content is unverified.
Prevent it next time: Use reserved hosts and explicit analysis scope.

Check your understanding

1. A page row exists but no visit links to it in the supplied fixture. What can be said?

Show worked solution

The supplied join has no matching visit for that page under the declared rule. It does not prove no historical visit occurred. Retention, synchronization, artifact type, schema interpretation, and incomplete material remain possible explanations. Preserve the row and missing-relationship status.

2. Does parsing view=public prove that public content was displayed?