Arc Browser

Overview

Arc is a Chromium-based browser from The Browser Company. Its standard browsing artifacts (history, cookies, saved logins and bookmarks) use Chrome's on-disk formats, so macfor parses them with the same Chromium infrastructure as the Chrome collector.

What makes Arc different is its organisational layer. Spaces, the sidebar's pinned tabs and folders, and Boosts (per-site customisations) live in Arc's own StorableSpaces*.json files, which macfor parses separately. These often show how a user organised their work, not just which sites they visited.

What macfor collects

A raw copy of the whole Arc data directory is also available, but it's opt-in and skipped by default.

Analysis tips

• Profile enumeration: macfor reads Local State to find every profile, and falls back to scanning the data directory if that file is missing or corrupt
• Spaces as context: Space names and their pinned tabs often map to projects, clients or personas, which helps explain browsing that looks unrelated in the history alone
• Boosts: a Boost can inject CSS or JavaScript into a site or redirect it, so treat unexpected Boosts as possible tampering or persistence
• Encrypted data: cookie values and saved passwords are protected by a Keychain key, and macfor records metadata only
• Undocumented schema: Arc's StorableSpaces format isn't publicly documented and changes between versions. macfor parses it defensively: unknown fields don't cause parsing to fail, but they are not written to the output. Enable the opt-in raw collection to keep the original file

WebKit timestamps

Like Chrome, Arc's Chromium databases use WebKit timestamps (microseconds since 1601-01-01 00:00:00 UTC):

WebKit timestamp = (Unix timestamp + 11644473600) * 1000000

Related artifacts

• Chrome Browser - Same Chromium formats
• Safari Browser - Compare cross-browser activity
• Firefox Browser - Additional browser coverage

References

• Arc by The Browser Company
• Chromium Source Code