Browser History Examiner - FAQs

Can I analyse history from a remote computer?

Yes, BHE includes a remote capture feature that allows you to capture history from another Windows computer on the same network. No installation is required on the remote machine you just need administrator access to it (either local or domain admin).

BHE Remote Capture Diagram

If you don't have network access to the remote machine you can use our free standalone capture tool, Browser History Capturer. This can be easily be run on each remote machine to capture history, which can then be manually copied back to your machine where BHE is installed.

How many installations do I need?

You don't need to install BHE on each computer you wish to analyse history from, you can simply use our capture process to pull history from other computers onto your computer where BHE is installed.

Can I load history from a forensic image?

Yes, you will need to mount the forensic image first as BHE does not directly support parsing forensic image files. Once the image is mounted as read-only you can simply point BHE at the appropriate Windows user profile within the mounted drive.

BHE Load Windows Profile

If you have an image of a Mac OS or Linux machine then you can use the 'Load history manually' option to specify the location of Firefox and Chrome history files within the mounted drive.

What is the difference between the Visit Count and URL Record Count columns?

The 'Visit Count' column is the count stored by the web browser, which generally gets incremented everytime the user visits a particular URL, however this can depend on how the URL was navigated to. For example, Chrome does not increment the visit count when a page is reloaded. The 'URL Record Count' column is the count of Website Visit records containing the same URL for a single browser (irrespective of how the URL was navigated to). The two counts will often match, however the URL Record Count may be greater if some website visits were page reloads for example, and the Visit Count may be greater if some website visit records have been deleted.