Blog >> Torch

Investigating Torch Web Browser

02/06/2021 Wednesday

Torch Browser is a web browser and an Internet suite developed by Torch Media. Torch is known for its media grabber, where it provides users with high-speed audio and video downloading capabilities, its built-in Torrent Manager, player, music, tons of free games, and the social media easy sharing feature. It is available for desktop Windows (Win7, Win8, and Win10).


Digital Forensics Value of Torch Artifacts


Web browsers data can be critical to a digital investigation since they serve as a user's window and access point to the World Wide Web and the rest of the world as well. Web browsers have become part of our daily lives thus, they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.


Location of Torch Artifacts


Torch Web Browser stores its files and folders at the following location:

C:\Users\%username%\AppData\Local\Torch\User Data\Default


Structure of Torch Artifacts


The structure of files containing Torch web browser artifacts is SQLite Databases. Each contains multiple tables with information regarding the users’ actions on the software.


Analyzing Torch Artifacts with ArtiFast Windows


This section will discuss how to use ArtiFast Windows to analyze Torch artifacts from Windows machines and what kind of digital forensics insights we can gain from the artifacts.

After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Torch artifacts:




ArtiFast can analyze Torch Autofill, Autofill Profiles, Bookmarks, Cache, Cookies, Credit Cards, Current Session, Current Tabs, Downloads, Extensions, Extension Cookies, Favicons, History, Last Session, Last Tabs, Logins, Shortcuts, Search Terms, Site Engagement, Top Sites, and Visits. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.



Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Torch artifacts in ArtiFast software.


Torch Autofill Artifact

Torch Autofill contains all of the values that the user has saved to fill in fields at a later date and time. The details you can view include:


Torch Autofill Profiles Artifact

Torch Autofill Profiles contains profiles that are used to represent a person. The details you can view include:


Torch Bookmarks Artifact

Torch Bookmarks are the shortcuts to the favorite and bookmarked webpages. It contains information such as:


Torch Cache Artifact

This artifact contains the cached entries in the Torch web browser. Torch Cache information includes:


Torch Cookies Artifact

Torch Cookies contains information about all of the cookies saved to the browser such as:


Torch Credit Cards Artifact

Torch Credit Cards contains all of the credit card information the user has saved. The details you can view include:


Torch Current Session Artifact

This artifact stores the browser's current available active session information from Torch web browser such as:


Torch Current Tabs Artifact

This artifact stores the multiple open Tabs in the current available active session information from Torch web browser such as:


Torch Downloads Artifact

Torch Downloads contains information about the downloaded files from Torch web browser. The details you can view include:


Torch Extension Artifact

This artifact contains the extension information from Torch web browser. The details you can view include:


Torch Extension Cookies Artifact

Torch stores the cookies used by the extensions. The details you can view include:


Torch Favicons Artifact

Torch Favicons stores all the small icons associated with a particular webpage that the user has favorited. The details you can view include:


Torch History Artifact

The Torch History artifact contains information about the visited URLs from Torch browser profile. The details you can view include:


Torch Last Session Artifact

This artifact stores the browser’s previous session information from Torch web browser. The details you can view include:


Torch Last Tabs Artifact

This artifact stores the multiple open tabs in the browser's last session from Torch web browser. The details you can view include:


Torch Logins Artifact

This artifact stores a user’s login information. The details you can view include:


Torch Search Terms Artifact

This artifact stores the user entered search terms. The details you can view include:


Torch Shortcuts Artifact

This artifact contains the shortcuts from Torch web browser. The details you can view include:


Torch Browser Site Engagement Artifact

This artifact stores information on the user interaction with site. The details you can view include:


Torch Top Sites Artifact

This artifact stores information about a user’s most frequently visited web pages such as:


Torch Visits Artifact

This artifact contains information of all visit dates with their URLs. The details you can view include: