Blog >> Brave

Investigating Brave Web Browser

27/07/2021 Tuesday

Brave is an open-source web browser developed by Brave Software. Brave web browser is known for its fast performance, security, and privacy. The web browser is available for desktop (Windows and macOS) and mobile devices (Android and iOS).


Digital Forensics Value of Brave Artifacts


Web browser data can be critical to a digital investigation since they serve as a user's window and access point to the World Wide Web and the rest of the world as well. Web browsers have become part of our daily lives thus, they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.


Location of Brave Artifacts


Brave web browser creates individual folders (profiles) for each user at the following location:
C:\Users\%username%\AppData\Local\BraveSoftware\Brave-Browser\User Data\%profilename%.default


Structure of Brave Artifacts


The majority of Brave web browser artifacts are maintained within SQLite database files, each contains multiple tables with information regarding the users’ actions on the software. Such as Brave autofill, history, and logins; however, some of the artifacts are stored within JSON files such as Brave bookmarks.


Analyzing Brave Artifacts with ArtiFast Windows


This section discusses how to use ArtiFast Windows to extract Brave browser artifacts from Windows machines and what kind of digital forensic insights can be gained from the artifacts.

After you have created your case and added evidence for the investigation at the Artifact Parser Selection Phase, you can select Brave web browser Artifacts:




ArtiFast can analyze Autofill, Autofill Profiles, Bookmarks, Cache, Cookies, Current Session, Last Session, Downloads, Extension, Extension Cookies, Favicons, History, Logins, Shortcuts, Search Terms, Site Engagement, Top Sites, Visits, Credit Cards, Ad Service Information, Ad Payment, Publisher Information, User Contributions, Pending Contributions, and Brave Origin Transformation Table. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.



Once ArtiFast parser plugins complete processing artifacts for analysis, they can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Brave artifacts in ArtiFast software.


Brave Ad Payment Artifact

The artifact contains the information about the payment made to user as advertisement reward. The details you can view include:


Brave Ad Service Information Artifact

The artifact contains contains information about the advertisements served by the browser. The details you can view include:


Brave Autofill Artifact

The artifact contains all of the values that the user has saved to fill in fields at a later date and time. The details you can view include:


Brave Autofill Profiles Artifact

The artifact contains all of the profiles that are used to represent a user. The details you can view include:


Brave Bookmarks Artifact

Brave Bookmarks are the shortcuts to the favorite and bookmarked webpages. It contains information such as:


Brave Cache Artifact

This artifact contains the cached entries in the Brave web browser. Brave Cache information includes:


Brave Cookies Artifact

The artifact contains information about all of the cookies saved to the browser such as:


Brave Credit Cards Artifact

The artifact contains all of the credit card information the user has saved. The details you can view include:


Brave Current Session Artifact

This artifact stores the browser's current available active session information from Brave web browser such as:


Brave Current Tabs Artifact

This artifact stores the multiple open tabs in the current available active session information from Brave Web browser such as:


Brave Downloads Artifact

The artifact contains information about the downloaded files from Brave web browser. The details you can view include:


Brave Extension Artifact

This artifact contains the extension information from Brave web browser. The details you can view include:


Brave Extension Cookies Artifact

This artifact stores the cookies used by the extensions. The details you can view include:


Brave Favicons Artifact

The artifact stores all the small icons associated with a particular webpage that the user has favorited. The details you can view include:


Brave History Artifact

The artifact contains the history data, which makes up most of the browsing information about a user. The details you can view include:


Brave Last Session Artifact

This artifact stores the browser’s previous session information from Brave web browser. The details you can view include:


Brave Last Tabs Artifact

This artifact stores the multiple open tabs in the browser's last session from Brave web browser. The details you can view include:


Brave Logins Artifact

This artifact stores a user’s login information. The details you can view include:


Brave Search Terms Artifact

This artifact stores the user entered search terms. The details you can view include:


Brave Shortcuts Artifact

This artifact contains the shortcuts from Brave web browser. The details you can view include:


Brave Browser Site Engagement Artifact

This artifact stores the Site Engagement Service information of how engaged a user is with a site. The details you can view include:


Brave Top Sites Artifact

This artifact stores information about a user’s most frequently visited web pages. The details you can view include:


Brave Visits Artifact

This Artifact contains more information about each time a URL is visited. The details you can view include:


Brave Publisher Information Artifact

This artifact contains information about web content publishers and user interaction with the content. The details you can view include:


Brave User Contribution Artifact

This artifact contains information on contributions to publishers by user. The details you can view include:


Brave Pending Contribution Artifact

This artifact contains information on pending contributions to publishers by user. The details you can view include:


Brave Origin Information Table Artifact

This artifact contains information on origin sites visited by user. The details you can view include: