In fact the more I look at these posts...I am not even certain if any of the following is new or original but I am posting examples of how to use SQLite and Python to parse Chrome files. In fact, if you want one comprehensive Python script for parsing all of the Chrome artifacts from the various versions of Chrome, grab a copy of hindsight by Ryan Benson from Obsidian Forensics. Looks like he used the source from Chromium to interpret the values in each of the tables. Top Notch.
First things first, which of Chromes files can you parse with SQLite?
Here is a quick and dirty way to find all of the Chrome SQLite files on Windows:
All of the sqlite files have an associated rollback journal with them. A rollback journal is a temporary file used to implement atomic commit and rollback capabilities in SQLite. Rollback journals have the same filename as the database file except there is a "-journal" appended to the end.
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\History is the sqlite database that stores Chrome's web history.
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\History-journal is it's rollback journal. With that in mind...
Or if you are into Apple's:
Or if you use Linux like a real forensicator...
By reviewing just these dir listings we can see that all three versions have the following files: Origin Bound Certs - DB of Origin-Bound Certificates (OBC). OBCs are a self-signed certificates that the browser uses to perform TLS Client Authentication. QuotaManager - Handles offline content quotas for AppCache, IndexedDB, WebSQL and File System API. Shortcuts - Contains info about the "omnibox" shortcuts that come up when you open a new tab or window. databases/Databases.db - Not 100% on these but I found an evercookie in one. Favicons - Keeps track of icons associated with web sites. History - The file that gets you in trouble with your boss/wife/priest. Network Action Predictor - When you start typing in stuff in the navigation bar, Google makes a guess at what you want a based on previous stuff you have looked and straight up voodoo. This file keeps track of what you type, what Google guessed, and how accurate the guess was based on whether or not you clicked on the guess they presented you with a list of options from the drop down that appears. This is a great artifact of attribute because it is generated by hands on keyboards. Application Cache/Index - Cache for Chrome Apps. Web Data - Contains mostly autofill data. Some useful timestamps. Login Data - Contains any username and password you have asked Chrome to store for you. This is in plaintext. Cookies - This is where Chrome stores all of the bits of crap that web sites use to remember you. Top Sites - Name says it all really. Extension Cookies - Cookies for Chrome Extensions Safe Browsing Cookies - Google use this for determining how well their server-side components are functioning.
Additionally, all 3 versions have local storage for extensions and websites that have been visited.
The format looks like this:Local Storage/PROTOCAL_DOMAINNAME_0.localstorage
We are already profiling user activity without even trying! Thanks Chrome!
This is all well and good but I promised you Python and Python you shall have but before you get too deep into code, download SQLite Browser.
It's cross platform and painless to use. This will make the road ahead a lot easier.
Note about using SQLite Browser to look at Chrome files: SQLite Browser is, by default, always looking for .sqlite files, and while these files are sqlite, they do not have the nifty extension. So you will need to select All files (*) from the drop down menu to see them.
Since I know most of you can manage a GUI, I am not going to bore you with explaining everything...
Open up any of the SQLite files we found earlier...let's say...History
And here is what that looks like...
This is everything you need to start cranking out some sweet SQLite parsin' Python scripts!
So lets say we wanted to get a list of all of the downloads from the History database.
Specifically, I want to know where it was saved to, where did it come from, the time it started downloading, when it finished, and how big it was when it was downloaded. The select statement would look a like this:
Let's wrap some python around it and bring this post to a close:
The output looks like this:
That is all for this post but I plan on digging a bit deeper on the next few.