SANS Digital Forensics and Incident Response Blog: Tag - Browser Forensics

21 Jan 2010

Google Chrome Forensics

15 comments Posted by kristinn
Filed under Browser Forensics, Computer Forensics

Google Chrome stores the browser history in a SQLite database, not unlike Firefox. Yet the structure of the database file is quite different.

Chrome stores its files in the following locations:

  • Linux: /home/$USER/.config/google-chrome/

  • Linux: /home/$USER/.config/chromium/

  • Windows Vista (and Win 7): C:\\Users\\[USERNAME]\\AppData\\Local\\Google\\Chrome\\

  • Windows XP: C:\\Documents and Settings\\[USERNAME]\\Local Settings\\Application Data\\Google\\Chrome\\

There are two different versions of Google Chrome for Linux, the official packets distributed by Google, which stores its data in the google-chrome directory and the Linux

...


Tags: browser, Browser Forensics, chrome, forensics
Share

Categories
Recent Posts
Archives
Links
Latest Blog Posts

A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
April 16, 2019 - 2:59 PM

A few Ghidra tips for IDA users, part 0 - automatic comments for API call p [...]
April 16, 2019 - 2:40 PM

SANS Threat Hunting and Incident Response Summit 2019 Call for Speakers – D [...]
April 08, 2019 - 7:31 PM

Latest Tweets @sansforensics

The Summit was awesome. It had tons of very relevant topics [...]
April 20, 2019 - 8:40 PM

Every analyst must have the core skills necessary to investi [...]
April 20, 2019 - 2:20 PM

Want to write better? Check out #SEC402 in NYC with @lennyze [...]
April 20, 2019 - 2:20 PM

Latest Papers

Evidence of Data Exfiltration via Containerised Applications on Virtual Private Servers
By Seth Enoka

Using Image Excerpts to Jumpstart Windows Forensic Analysis
By John Brown

Windows 10 as a Forensic Platform
By Ferenc Kovacs

"For my line of work, basic & extensive understanding of the file system is extremely important. The literature and books on file systems for me are very critical & thanks you for them, great reference material"
- Vince Ramirez, Las Vegas Metro P.D.

"I had taken several other forensic courses prior to this one, but none of them or their instructors made understanding forensic methodologies and techniques as clear and understandable as Rob Lee and this course has."
- Nathon Heck, Purdue

"Rob Lee is a master of the subject matter. The material is presented in a way that is understandable. Rob is also charismatic enough to make the course enjoyable."
- Erik Ketlet, JP Morgan Chase