CHFI OS and Network Forensics Practice Question
A forensic analyst is examining browser history from a Chrome installation on a Windows system. Where is the Chrome history database typically stored?
⚠ Common exam trap
EC-Council often tests the distinction between browser-specific storage paths, and the trap here is that candidates confuse the Chrome history location with Firefox's profile path or Internet Explorer's Favorites folder, leading them to pick Option A or C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
%LOCALAPPDATA%\Google\Chrome\User Data\Default\History
Chrome stores its browsing history in a SQLite database file named 'History' located under the user's local app data directory. The full path is %LOCALAPPDATA%\Google\Chrome\User Data\Default\History. This file contains tables such as 'urls' and 'visits' that record all visited URLs, timestamps, and visit counts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
%APPDATA%\Mozilla\Firefox\Profiles\
Why it's wrong here
%APPDATA%\Mozilla\Firefox\Profiles\ is the root container for Firefox user profiles, not a path to any Chrome data. Within a Firefox profile subfolder (e.g., <profile>.default), the history and bookmarks are stored together in a single SQLite database named places.sqlite, but this is a completely different browser. Even if an analyst expects Mozilla data, this specific directory listing is just the profiles folder, not the actual history database file, and it cannot be used to locate Chrome's History artifact.
- ✗
%WINDIR%\System32\config\
Why it's wrong here
%WINDIR%\System32\config\ contains the Windows registry hive files (such as SAM, SECURITY, SOFTWARE, and SYSTEM) and is the system-wide configuration store, not per-user application data. Chrome's browsing history is maintained within the user's local profile under %LOCALAPPDATA%\Google\Chrome, not in the system root. Furthermore, restricted access control entries on this folder prevent even administrators from casually reading it, making it an implausible location for a user-specific browser history database.
- ✗
%USERPROFILE%\Favorites\
Why it's wrong here
%USERPROFILE%\Favorites\ is the legacy location for Internet Explorer and Microsoft Edge favorites (bookmarks) stored as .url shortcuts, which are manually saved by the user. Chrome history, in contrast, is an automatically logged SQLite database containing every visited URL with timestamps, visit counts, and transition types; the Favorites folder has no such records. Thus, this path could yield bookmark artifacts on a system using IE, but it cannot provide Chrome's chronological browser history data, so it is incorrect for this question.
- ✓
%LOCALAPPDATA%\Google\Chrome\User Data\Default\History
Why this is correct
%LOCALAPPDATA%\Google\Chrome\User Data\Default\History is the precise path to Chrome's SQLite database that stores browsing history. This file contains multiple key tables, including 'urls' and 'visits', which record the full URL, visit time, page title, and transition type (e.g., typed, link, or reload). Because Chrome locks the file while running, a forensic examiner should make a forensic copy via a live acquisition tool or volume shadow copy before analysis, then examine it with SQLite forensics tools to recover the user's browsing activity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.