Arc

Arc Cookies

Overview

Arc stores cookies in a Chromium Cookies SQLite database in each profile directory. The format is identical to Chrome's: one row per cookie with host, name, path, flags, timestamps, and an encrypted value. See Chrome Cookies for the full cookies and meta table schema and the SameSite, priority, and source-scheme value tables.

File Locations

ArtifactPath
Cookies database~/Library/Application Support/Arc/User Data/{Profile}/Cookies
Journal file~/Library/Application Support/Arc/User Data/{Profile}/Cookies-journal

Each profile has its own cookie jar. Arc ties Spaces to profiles, so cookies for a site may exist in some profiles and not others. Use the profile recorded for each Space in Spaces to work out which Space a session belonged to.

Key Fields

ColumnMeaning
host_keyDomain the cookie belongs to (a leading . means subdomains too)
name, pathCookie identity
encrypted_valueAES-encrypted value (prefixed v10 on macOS); value is normally empty
creation_utcWhen the cookie was first set
last_access_utcWhen the browser last sent the cookie
last_update_utcWhen the cookie was last changed (newer Chromium versions)
expires_utcExpiry; 0 for session cookies
is_secure, is_httponly, samesiteSecurity attributes
is_persistent, has_expiresPersistent vs. session cookie

Timestamps

All cookie timestamps are WebKit format: microseconds since 1601-01-01 00:00:00 UTC.

SELECT
    host_key,
    name,
    datetime(creation_utc / 1000000 - 11644473600, 'unixepoch')    AS created_utc,
    datetime(last_access_utc / 1000000 - 11644473600, 'unixepoch') AS last_access_utc,
    CASE WHEN expires_utc = 0 THEN 'session'
         ELSE datetime(expires_utc / 1000000 - 11644473600, 'unixepoch') END AS expires
FROM cookies
ORDER BY last_access_utc DESC;

Encryption

Cookie values are encrypted

encrypted_value is AES-128-CBC encrypted with a key derived (PBKDF2-SHA1, 1003 iterations, salt saltysalt) from a secret in the user's login Keychain. Chromium browsers name this item <Browser> Safe Storage. Confirm the exact name for Arc in the subject's keychain. Reading it requires the user's keychain password or an unlocked session. Decrypt only with proper authorisation.

The cookie metadata is forensically useful even without decryption. Host, name, and timestamps show which services the user was signed in to and when the browser last talked to them.

Analysis Notes

  • Sessions and accounts. Authentication cookie names (e.g. SID, session, auth_token) on a host show the user had a signed-in session there.
  • Last access vs. history. last_access_utc updates whenever the browser sends the cookie, including background requests. It can show activity on a domain that has no matching history visit.
  • Per-profile comparison. Compare the same host_key across profiles to see which profile, and therefore which Space, was used for a service.

What macfor Collects

The browser.arc plugin parses Cookies in every profile and emits browser_cookie records with browser: arc. Each record carries the metadata and encrypted: true. macfor never decrypts cookie values.

References

Previous
History
Next
Spaces