|
Executive summary: The search information is stored in a sqlite3 database format in a file called formhistory.sqlite. To see your searches from within the built-in google toolbar in firefox use
select * from moz_formhistory where fieldname like '%search%';
and to see your searches from google's homepage use
select * from moz_formhistory where fieldname='q';
Full breakdown: Firefox stores your form history in ~/.mozilla/firefox/xxxxxxxx.default/formhistory.sqlite on Linux systems and C:\Documents and Settings\yyyyyy\Application Data\Mozilla\Firefox\Profiles\xxxxxxxx.default\formhistory.sqlite on Windows. The xxxxxxxx is a random sequence of letters which varies from machine to machine (e.g. on my computer it is dwvvh4ge) and yyyyyy denotes your windows username. Dumping the head of the file shows its an sqlite 3 file:
cianer@Feegle:~/.mozilla/firefox/dwvvh4ge.default$ xxd formhistory.sqlite | head
0000000: 5351 4c69 7465 2066 6f72 6d61 7420 3300 SQLite format 3.
0000010: 0400 0101 0040 2020 0000 0bc9 0000 0000 .....@ ........
0000020: 0000 0000 0000 0000 0000 0006 0000 0002 ................
0000030: 0000 0000 0000 0000 0000 0001 0000 0001 ................
0000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000060: 0000 0000 0d03 7300 0301 d900 01d9 02ff ......s.........
0000070: 029e 0000 0000 0000 0000 0000 0000 0000 ................
0000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
cianer@Feegle:~/.mozilla/firefox/dwvvh4ge.default$
Open the file using sqlite3 and get the list of tables:
cianer@Feegle:~/.mozilla/firefox/dwvvh4ge.default$ sqlite3 formhistory.sqlite
SQLite version 3.6.10
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> SELECT name FROM sqlite_master WHERE type='table' ORDER BY name;
moz_dummy_table
moz_formhistory
sqlite>
This lists two tables: moz_dummy_table and moz_formhistory. Clearly the one we are interested in is moz_formhistory so enable printing of headers & dump the first 5 entries of that table, thus:
sqlite> .headers ON
sqlite> select * from moz_formhistory limit 5;
id|fieldname|value|timesUsed|firstUsed|lastUsed
1|searchbar-history|ubuntu dns cache flush|1|1244454392623828|1244454392623828
2|Email|cian.masterson|5|1244454470183963|1253810633913969
3|vb_login_username|cianer|3|1244454615512173|1248098723979285
4|searchbar-history|ubuntu cannot access gmail|1|1244454665107244|1244454665107244
5|searchbar-history|xboxlive with chipped xbox|2|1244454898958761|1244455460459202
sqlite>
As you can see some entries are searchbar-history which means items we searched for using the built-in google toolbar in firefox. The numbers in the last column are the timestamps in unix time that the search was done. Converting we can see that I searched for "ubuntu dns cache flush" on timestamp 1244454392623828 which is Mon Jun 8 2009, at 10:46:32.
Searches done from the built-in google toolbar: If we just want to see searchbar history we can limit that to entries where fieldname contains "search", thus:
sqlite> select * from moz_formhistory where fieldname like '%search%' limit 5;
1|searchbar-history|ubuntu dns cache flush|1|1244454392623828|1244454392623828
4|searchbar-history|ubuntu cannot access gmail|1|1244454665107244|1244454665107244
5|searchbar-history|xboxlive with chipped xbox|2|1244454898958761|1244455460459202
6|searchbar-history|ubuntu dns cache|1|1244455556170967|1244455556170967
33|searchbar-history|aib skerries|1|1244480974269927|1244480974269927
sqlite>
Searches done from google's homepage: The search form in google's homepage is simply called q so doing a search for fieldname='q' gives us our google searches from the homepage:
sqlite> select * from moz_formhistory where fieldname='q' limit 5;
132|q|android launch app from within another|1|1244721531186224|1244721531186224
136|q|joomla template|1|1244722481218866|1244722481218866
137|q|templates|1|1244722569809767|1244722569809767
162|q|linksys srw224p password|1|1244795751931792|1244795751931792
163|q|linksys srw224p default|1|1244795760284350|1244795760284350
sqlite>
The most convenient way to convert from the unix timestamp to a human-readable time is to use this cool bit of perl written by Hannes:
perl -pe 's,(\d{16}),localtime($1/1000000),eg'
Type that on the command line then paste the entry into STDIN and it will convert it for you, much like this:
cianer@Feegle:~/.mozilla/firefox/dwvvh4ge.default$ perl -pe 's,(\d{16}),localtime($1/1000000),eg'
1|searchbar-history|ubuntu dns cache flush|1|1244454392623828|1244454392623828
1|searchbar-history|ubuntu dns cache flush|1|Mon Jun 8 10:46:32 2009|Mon Jun 8 10:46:32 2009
cianer@Feegle:~/.mozilla/firefox/dwvvh4ge.default$
|
