Blog >> UC

Investigating UC Web Browser

29/06/2021 Tuesday

UC Browser is a web browser developed by mobile internet company UCWeb. UC Browser is known for providing a fast, secure, video streaming, high-speed downloads, and an ad-free browsing experience. It is an easy-to-use and simple web browser. It is available for desktop (Windows and macOS) and mobile devices (Android and iOS).


Digital Forensics Value of UC Artifacts


Web browser data can be critical to a digital investigation since they serve as a user's window and access point to the World Wide Web and the rest of the world as well. Web browsers have become part of our daily lives thus, they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.


Location of UC Artifacts


UC web browser creates individual folders (profiles) for each user at the following location:
C:\Users\%username%\AppData\Local\UCBrowser\User Data_i18n\%profilename%.default


Structure of UC Artifacts


The majority of UC web browser artifacts are maintained within SQLite database files, each contains multiple tables with information regarding the users’ actions on the software. Such as UC autofill, history, and downloads; however, some of the artifacts are stored within JSON files such as UC bookmarks.


Analyzing UC Artifacts with ArtiFast Windows


This section discusses how to use ArtiFast Windows to extract UC browser artifacts from Windows machines and what kind of digital forensic insights can be gained from the artifacts.

After you have created your case and added evidence for the investigation at the Artifact Parser Selection Phase, you can select UC web browser Artifacts:




ArtiFast can analyze UC Autofill, Autofill Profiles, Bookmarks, Cache, Cookies, Current Session, Last Session, Downloads, Favicons, History, Logins, Shortcuts, Search Terms, Site Engagement, Top Sites, Visits, Credit Cards, and Omnibox. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.



Once ArtiFast parser plugins complete processing artifacts for analysis, they can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of UC artifacts in ArtiFast software.


UC Autofill Artifact

The artifact contains all of the values that the user has saved to fill in fields at a later date and time. The details you can view include:


UC Autofill Profiles Artifact

The artifact contains all of the profiles that are used to represent a user. The details you can view include:


UC Bookmarks Artifact

UC Bookmarks are the shortcuts to the favorite and bookmarked webpages. It contains information such as:


UC Cache Artifact

This artifact contains the cached entries in the UC web browser. UC Cache information includes:


UC Cookies Artifact

The artifact contains information about all of the cookies saved to the browser such as:


UC Credit Cards Artifact

The artifact contains all of the credit card information the user has saved. The details you can view include:


UC Current Session Artifact

This artifact stores the browser's current available active session information from UC web browser such as:


UC Current Tabs Artifact

This artifact stores the multiple open tabs in the current available active session information from UC Web browser such as:


UC Downloads Artifact

The artifact contains information about the downloaded files from UC web browser. The details you can view include:


UC Favicons Artifact

The artifact stores all the small icons associated with a particular webpage that the user has favorited. The details you can view include:


UC History Artifact

The artifact contains information about the visited URLs from UC browser profile. The details you can view include:


UC Last Session Artifact

This artifact stores the browser’s previous session information from UC Web browser. The details you can view include:


UC Last Tabs Artifact

This artifact stores the multiple open tabs in the browser's last session from UC web browsers. The details you can view include:


UC Logins Artifact

This artifact stores a user’s login information. The details you can view include:


UC Search Terms Artifact

This artifact stores the user entered search terms. The details you can view include:


UC Shortcuts Artifact

This artifact contains the shortcuts from UC web browser. The details you can view include:


UC Browser Site Engagement Artifact

This artifact stores information on the user interaction with site. The details you can view include:


UC Top Sites Artifact

This artifact stores information about a user’s most frequently visited web pages. The details you can view include:


UC Visits Artifact

This artifact contains information of all visit dates with their URLs. The details you can view include:


UC Omnibox Artifact

This artifact contains information about omnibox usage. The details you can view include: