← All artifacts

Chrome Browser

Google Chrome browser artifacts including history, downloads, bookmarks, cookies, saved passwords, extensions, and session data.

Status
available
CLI plugin
browser.chrome
Categories
browser, user

Overview

Chrome browser artifacts are essential for web activity analysis. Chrome's multi-profile support means each user profile maintains separate artifact sets, requiring enumeration of all profiles during collection.

Analysis Tips

  • Profile enumeration: Check Local State file for all configured profiles
  • Transition types: Analyze visit transition types to understand navigation patterns
  • Encrypted data: Cookie and password values are encrypted with Keychain
  • Extension permissions: Review extension permissions for potential security risks
  • Session recovery: Examine Current Session and Last Session SNSS files

Chrome Variants

macfor collects artifacts from multiple Chrome variants:

VariantLocation
Chrome Stable~/Library/Application Support/Google/Chrome/
Chrome Canary~/Library/Application Support/Google/Chrome Canary/
Chromium~/Library/Application Support/Chromium/

WebKit Timestamps

Chrome uses WebKit timestamps (microseconds since 1601-01-01 00:00:00 UTC):

WebKit timestamp = (Unix timestamp + 11644473600) * 1000000

Related Artifacts

References

Data sources

HistorySQLite

~/Library/Application Support/Google/Chrome/Default/

Browsing history, downloads, and search terms

CookiesSQLite

~/Library/Application Support/Google/Chrome/Default/

Encrypted cookie data

BookmarksJSON

~/Library/Application Support/Google/Chrome/Default/

User bookmarks tree structure

Login DataSQLite

~/Library/Application Support/Google/Chrome/Default/

Saved login credentials (encrypted)

Web DataSQLite

~/Library/Application Support/Google/Chrome/Default/

Autofill data, addresses, payment methods

Local StorageLevelDB

~/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/

Website local storage data