[SOLVED] downloads.sqlite in firefox gone ?

[like2code]

First of all: Sorry if this is the wrong section. Also hi.

I am currently writing some forensic(saved passes, history, downloads, ...) script for firefox (so far), and can't find the downloads.sqlite on my win7 machine with ff 29.
It exists on an debian install with an older ff version.
The list with the downloads via the ff GUI is working, so these data need to be somewhere.
So, does anyone know if the data is now in another file, or do i need to dig through the ff code ?

EDIT: Firefox from version 21 upwards (?) saves this data in the places.sqlite now. This is one way how to get that info:

Code: [Select]

SELECT a.content, b.content, c.content from moz_annos a, moz_annos b, moz_annos c
where a.place_id = b.place_id and b.place_id = c.place_id
and a.anno_attribute_id = 17
and b.anno_attribute_id = 18
and c.anno_attribute_id = 19;

*BTW: if there is interest i'll post the script here, when it is done.*

[Phage]

I would suggest you check out this page:
http://mzl.la/NYhKHH

Let me know if you need more help, I'm part of Mozilla's support team.

[like2code]

Thanks for the response.
I already read that page, and know where to find the profile (everything is working already with the places.sqlite).
My problem is: there is no downloads.sqlite in my profile folder on my win system (ff 29).

Update: I think i found the changes.
http://www.forensicswiki.org/wiki/Mozilla_Firefox:

Note it looks that Firefox 21 (or earlier?) stores the downloads as part of the bookmarks in moz_bookmarks and moz_annos in places.sqlite

See first post in this thread for solution for ff >= 21

[BlindChance]

Thanks for the code it saved me a headache. I know someone might grumble about resurrecting old thread, but this information needs a correction.

A quick fix for anyone interested i.e. DFIR people. In my case I had to use the following query:

SELECT a.content, b.content, c.content from moz_annos a, moz_annos b, moz_annos c
    where a.place_id = b.place_id and b.place_id = c.place_id
    and a.anno_attribute_id = 12
    and b.anno_attribute_id = 13
    and c.anno_attribute_id = 14;

In case you will get unexpected or no results you can find the correct IDs in the "moz_anno_attributes" table.

You are looking for names:

downloads/destinationFileURI
downloads/destinationFileName
downloads/metaData

and their corresponding IDs.

So in my case the OP's code returned nothing, but after changing the ID's I got my Firefox download list. For easy access I suggest using SQLite Manger addon for Firefox, easy and fast to use, just point to the places.sqlite file and run the query from the "Execute SQL" tab.