The profile location is "C:\Users\<username>AppData\Local\" is for temp files like the disk cache. You won't find any personal data like history in this location (local directory in about:profiles). As you noticed places.sqlite is located in "AppData\Roaming" (root directory in about:profiles) and that is the location for the main profile folder with your personal data.

If you do not have a backup of places.sqlite, also not in previous versions as part of a Windows System Restore point then I'm afraid that your history is lost.

You can look at a utility to browse System Restore points.

• https://www.nicbedford.co.uk/software/systemrestoreexplorer/
• https://www.shadowexplorer.com/

See also:

• https://support.mozilla.org/en-US/kb/recovering-important-data-from-an-old-profile

cor-el said

The profile location is "C:\Users\<username>AppData\Local\" is for temp files like the disk cache. You won't find any personal data like history in this location (local directory in about:profiles). As you noticed places.sqlite is located in "AppData\Roaming" (root directory in about:profiles) and that is the location for the main profile folder with your personal data. If you do not have a backup of places.sqlite, also not in previous versions as part of a Windows System Restore point then I'm afraid that your history is lost. You can look at a utility to browse System Restore points.

• https://www.nicbedford.co.uk/software/systemrestoreexplorer/
• https://www.shadowexplorer.com/

---

See also:

• https://support.mozilla.org/en-US/kb/recovering-important-data-from-an-old-profile

I do see a places.sqlite in C:\Users\<username>AppData\Roaming\Mozilla\Firefox\Profile\<Random profile name>\places.sqlite.

It's 80MB size with "Creation date" in year 2015, and "Last Modified date" of today (1-7-2019). Is it possible that it could have ALL history? How do I confirm for sure?

If it was completely deleted it's creation-date would have to be just 4-5 days ago (when browsing history got deleted in a script). But it seems to have creation in 2015 and size of 80MB.

Does it stores anything else other than browsing-history as 80MB of browsing history links in a few days seems too large?

The places.sqlite file contains bookmarks, downloads history, and browsing history; all of which are considered "Places".

As far as the "creation date" for the places.sqlite file, that would have been when that Profile was originally created.

I wondered what type of "cleanup script" you ran. If it was solely for browsing history (and possibly downloads history) , it wouldn't have touched your bookmarks.

When you clear history only involved data is removed (replaced by null bytes), but places.sqlite is not reduced in file size. Only when a 'vacuum' is performed (e.g. via "Verify Integrity") them places.sqlite is compacted.

the-edmeister said

The places.sqlite file contains bookmarks, downloads history, and browsing history; all of which are considered "Places". As far as the "creation date" for the places.sqlite file, that would have been when that Profile was originally created. I wondered what type of "cleanup script" you ran. If it was solely for browsing history (and possibly downloads history) , it wouldn't have touched your bookmarks.

I still see all my bookmarks, only history is gone. Is it possible all history is still there somewhere hidden in this places.sqlite file? otherwise how can it be 80MB size only in a few days under normal use?

It was the FRST script to remove malware from bleepingcomputer.com.

cor-el said

The profile location is "C:\Users\<username>AppData\Local\" is for temp files like the disk cache. You won't find any personal data like history in this location (local directory in about:profiles). As you noticed places.sqlite is located in "AppData\Roaming" (root directory in about:profiles) and that is the location for the main profile folder with your personal data. If you do not have a backup of places.sqlite, also not in previous versions as part of a Windows System Restore point then I'm afraid that your history is lost. You can look at a utility to browse System Restore points.

• https://www.nicbedford.co.uk/software/systemrestoreexplorer/
• https://www.shadowexplorer.com/

---

See also:

• https://support.mozilla.org/en-US/kb/recovering-important-data-from-an-old-profile

I used the systemrestoreexplorer/ tool above to see the restore point. One is from 12-30-2019 (3 days before deletion on 1-2-2020) and another from 12-19-2019.

So could I just copy this file? C:\HarddiskVolumeShadowCopy4\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\<Random profile name>\places.sqlite to C:\Users\<username>AppData\Roaming\Mozilla\Firefox\Profile\<Random profile name>\places.sqlite

Would it affect anything else, like the bookmarks in Mozilla or any other issues?

I also noticed that if I go to History->Show_All_History->Library->Import and Backup->Restore-> <Various date options in last 20 days>

Do these refer to browsing-history data up until that date?

it shows me EACH of last 20 days. When I click on say "Tuesday, Dec 31st, 2019 (237 KB - 1667 items)", it pops a message saying

"Revert Bookmarks - This will replace all of your current bookmarks with the backup. Are you sure?"

That makes me concerned if it's not history data and just bookmarks. Could you please explain what it is I am seeing in this?

In folder C:\Users\<username>AppData\Roaming\Mozilla\Firefox\Profile\<Random profile name>\, I just renamed places.sqlite to OLD-1-7-2020-places.sqlite and copied places.sqlite from Dec 30, 2019 restore point to original places.sqlite.

Now I can see history going back to 2018. The issues is:

- No history after Dec 30, 2019 (that's ok) - No bookmarks after Dec 30, 2019.

Is this overwriting of places.sqlite has any other unintended modifications than history? Can I get sites bookmarked after Dec 30, 2019 added easily?

Replacing places.sqlite gives you the bookmarks and history stored in that copy of the file.

You can restore a recent compressed .jsonlz4 JSON backup that should have all your bookmarks.

• Bookmarks -> Show All Bookmarks -> Import & Backup -> Restore

The name of an automatically created JSON bookmarks backup in the bookmarkbackups folder includes a total item count (folders and separators included) and an hash value to prevent saving the same backup more than once. You also see this count in the Restore menu drop-down list. You can use this count to select the correct backup for restoring.

• bookmarks-YYYY-MM-DD_<item count>_<hash>.jsonlz4.

If you already created new bookmarks then make a note and re-add them later.

cor-el said

You can restore a recent compressed .jsonlz4 JSON backup that should have all your bookmarks.

• Bookmarks -> Show All Bookmarks -> Import & Backup -> Restore

So if I did this Import & Backup -> Restore-> Jan 6, 2020, it'd give me all my current bookmarks and the ones added after Dec 30, 2019. Is that true? No other consequences?

I want to make sure using systemrestoreexplorer software above to copy places.sqlite didn't have any other consequence than affecting bookmarks (it gave me history prior to Dec 30, 2019).

cor-el said

If you already created new bookmarks t'hen make a not 'and re-add them later.

Not sure what this means?

For previous suggestions:

Back up your existing places.sqlite before recovering an old one.

One can also use DB Browser for SQLite to look inside the files, although it is not the most user-friendly experience for most people.

Restoring from .jsonlz4 JSON restores exactly that file, as far as i know. An option to Import (from HTML backup) would add the entire bookmark structure to a new folder inside the existing bookmark structure.

If you already created new bookmarks then make a not and re-add them later.

This means that you should make a new note of any bookmarks you have added since the backup date, as they will not be kept. You are replacing the file with the backup, the backup and existing set are not merged.