Samsung Internet History on Android
Samsung Internet on Android: the Chromium History database, downloads and search terms, Samsung's own tab and bookmark stores, and Secret mode limits.
- Location
- /data/data/com.sec.android.app.sbrowser/app_sbrowser/Default/History
- Proves
- Web pages visited in Samsung Internet's normal mode, with per-visit times and navigation type, typed URLs, search terms and downloads
- Timestamps
- WebKit/Chrome time: microseconds since 1601-01-01 UTC (urls.last_visit_time, visits.visit_time, downloads.start_time and end_time)
- Access
- Full file system (root, exploit or agent); credential-encrypted sandbox, so AFU only. Logical: downloaded files in shared storage only. Not in ADB backup on current versions.
- Retention
- Chromium expires history after about 90 days; the user can clear it at any time; Secret mode browsing is not written to this database
- Collection
- Full file system extraction, adb pull of /sdcard/Download
Tools
Compare all toolsWhat it is
Samsung Internet (com.sec.android.app.sbrowser) is the default browser on Samsung Galaxy phones and is also installable from Google Play on other Android devices. It is built on Chromium, and its browsing history uses the same History SQLite schema as Chrome: urls, visits, downloads, keyword_search_terms. Everything you know about Chrome history applies, with a different sandbox path and a few Samsung additions around it.
On a Galaxy phone where the user never installed another browser, this is often the only browsing history on the device.
Where it lives
| Item | Path | Notes |
|---|---|---|
| History | /data/data/com.sec.android.app.sbrowser/app_sbrowser/Default/History (+ -journal or -wal) | Chromium schema |
| Other Chromium files | app_sbrowser/Default/ | Cookies, Web Data (autofill), Login Data, Favicons, Top Sites, Shortcuts |
| Samsung databases | /data/data/com.sec.android.app.sbrowser/databases/ | Bookmarks, saved pages, open tabs and quick access tiles on many versions (names such as SBrowser.db vary: verify) |
| Downloads | /sdcard/Download/ | Downloaded files; the record of where they came from is in History |
Samsung Internet beta (com.sec.android.app.sbrowser.beta) uses the same layout under its own package name.
What it proves
- Every URL visited in normal mode, with its title, visit count and typed count.
- Each individual visit with its time, duration where recorded, and transition type (typed, link, bookmark, reload, form submission, redirect).
- Terms typed into the address bar that were sent to a search engine.
- Files downloaded, the page they came from, the final path, size and start and end times: the classic route by which a sideloaded APK reaches the phone.
It does not record Secret mode browsing. Secret mode keeps its own protected store, can be locked with a password or biometrics, and discards history when the session ends.
Key fields
| Table | Columns | Meaning |
|---|---|---|
urls | id, url, title, visit_count, typed_count, last_visit_time, hidden | One row per unique URL |
visits | id, url, visit_time, from_visit, transition, visit_duration | One row per visit |
keyword_search_terms | keyword_id, url_id, term, normalized_term | Search terms |
downloads | id, target_path, start_time, end_time, received_bytes, total_bytes, state, danger_type, tab_url, referrer, mime_type | Downloads |
downloads_url_chains | id, chain_index, url | Redirect chain behind each download |
The core transition value is transition & 0xFF (0 link, 1 typed, 2 auto bookmark, 8 reload...). Samsung builds track upstream Chromium closely but lag by some versions; a column may appear or disappear a few releases later than in Chrome.
Timestamps
Chromium time is microseconds since 1601-01-01 UTC.
SELECT u.url, u.title,
datetime(v.visit_time/1000000 - 11644473600, 'unixepoch') AS visit_utc,
v.transition & 0xFF AS core_transition
FROM visits v JOIN urls u ON u.id = v.url
ORDER BY v.visit_time;
Samsung's own databases in databases/ typically use Unix milliseconds instead; label the source of every time when merging.
Retention
Chromium removes history older than about 90 days. The user can delete individual entries or clear all history, which removes rows but often leaves pages in the WAL or free space for a while. Uninstalling or clearing app data removes the sandbox; downloaded files in shared storage remain.
Collection
- Full file system extraction (AFU): copy the whole
app_sbrowser/Defaultfolder with journals, plus thedatabases/folder. - Logical: shared storage gives you the downloaded files and nothing about the browsing.
- Samsung account sync (Samsung Cloud) can hold bookmarks and open tabs server side, subject to legal process.
Parsing
- Browser Forensics opens the Samsung Internet
Historyfile in the browser: visited URLs, per-visit timeline, downloads and search terms, the same views as for Chrome. - ALEAPP parses Samsung Internet alongside Chrome and other Chromium browsers.
- Hindsight reads Chromium profiles, and the commercial suites include Samsung Internet in their web history.
Investigator tips
- For a sideloading case, find the APK in
downloads, then its install in installed packages: on Android 11+ theinstallInitiatorshould becom.sec.android.app.sbrowser. - Check whether Chrome is also in use: many Galaxy users have both, and Chrome history is a separate database.
- Pair visits with usagestats foreground events to show the browser was on screen.
- Images saved from the web land in shared storage without camera EXIF; see DCIM and MediaStore to tell them apart.
- A logged-in Samsung account appears in the accounts databases.