SANS Digital Forensics and Incident Response Blog: Tag - Browser Forensics

Google Chrome Forensics

Google Chrome stores the browser history in a SQLite database, not unlike Firefox. Yet the structure of the database file is quite different.

Chrome stores its files in the following locations:

  • Linux: /home/$USER/.config/google-chrome/
  • Linux: /home/$USER/.config/chromium/
  • Windows Vista (and Win 7): C:\\Users\\[USERNAME]\\AppData\\Local\\Google\\Chrome\\
  • Windows XP: C:\\Documents and Settings\\[USERNAME]\\Local Settings\\Application Data\\Google\\Chrome\\

There are two different versions of Google Chrome for Linux, the official packets distributed by Google, which stores its data in the google-chrome directory and the Linux