Chrome
Chrome Browser
Overview
Google Chrome is the most widely used web browser globally, making it a high-priority target in forensic investigations. Chrome stores browsing artifacts in a combination of SQLite databases, JSON files, LevelDB key-value stores, and proprietary SNSS binary session files.
Chrome on macOS supports multiple simultaneous profiles, each with its own complete set of artifact databases. This multi-profile architecture is common in enterprise and shared environments and must be accounted for during collection.
Chrome uses the Chromium open-source engine, meaning that other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) share similar artifact structures and storage formats, though they use different base directories.
Supported Variants
macfor collects artifacts from three Chrome-related variants on macOS:
| Variant | Base Path | Application |
|---|---|---|
| Google Chrome | ~/Library/Application Support/Google/Chrome/ | /Applications/Google Chrome.app |
| Google Chrome Canary | ~/Library/Application Support/Google/Chrome Canary/ | /Applications/Google Chrome Canary.app |
| Chromium | ~/Library/Application Support/Chromium/ | /Applications/Chromium.app |
Profile Structure
Chrome supports multiple user profiles within a single installation. Profile metadata is stored in the Local State JSON file at the root of the Chrome data directory.
| Profile Type | Directory Name |
|---|---|
| Default | Default/ |
| Additional profiles | Profile 1/, Profile 2/, etc. |
| Guest | Guest Profile/ |
| System | System Profile/ |
The Local State file contains a profile.info_cache object mapping directory names to profile metadata, including the display name, Google account email, and avatar index.
Artifact Summary
Each profile directory contains the following artifacts:
| Artifact | File | Format | Forensic Value |
|---|---|---|---|
| History | History | SQLite | Browsing activity, visits, downloads, search terms |
| Bookmarks | Bookmarks | JSON | Sites of interest, organisational patterns |
| Cookies | Cookies | SQLite | Authentication tokens, tracking data (encrypted) |
| Saved Passwords | Login Data | SQLite | Credential metadata (encrypted passwords) |
| Autofill | Web Data | SQLite | Form data, addresses, credit card metadata |
| Extensions | Extensions/ | Directory/JSON | Installed modifications, potential malware |
| Local Storage | Local Storage/leveldb/ | LevelDB | Web application data, authentication tokens |
| Sessions | Current Session, Last Session | SNSS binary | Open tabs, window state, navigation history |
| Preferences | Preferences | JSON | User settings, search engine, startup config |
Timestamps
All Chrome timestamps use the WebKit/Chrome format: microseconds since 1601-01-01 00:00:00 UTC.
To convert to Unix epoch:
unix_microseconds = webkit_timestamp - 11644473600000000
A value of 0 indicates an unset or missing timestamp.
Encryption
Chrome on macOS encrypts sensitive values (cookie values, saved passwords, credit card numbers) using the macOS Keychain. The encryption key is stored under:
- Keychain Service:
Chrome Safe Storage - Keychain Account:
Chrome
The encryption uses AES-128-CBC with PBKDF2 key derivation (1003 iterations, SHA1). macfor collects encrypted values without decryption -- analysts can decrypt using separate tools with proper authorisation.
Collection Order
macfor collects Chrome artifacts in a defined order to ensure consistency:
- History (including downloads and search terms)
- Bookmarks
- Cookies
- Login Data
- Web Data (autofill)
- Extensions
- Local Storage
- Sessions
- Preferences
Version Compatibility
macfor supports Chrome versions 80 and above on macOS 10.12 (Sierra) and later. The collector uses dynamic column detection to handle schema differences across Chrome versions, falling back to sensible defaults when columns are absent in older databases.
Tool Support
| Tool | Support |
|---|---|
| macfor | Full collection of all artifact types across all profiles |
| Hindsight | Browser history analysis (open source) |
| DB Browser for SQLite | Manual database inspection |
| ChromeCacheView (NirSoft) | Cache file examination |
| AXIOM | Commercial forensic suite with Chrome support |