Chrome Sessions

Overview

Chrome stores browser session state -- open windows, tabs, navigation history, and tab properties -- in proprietary binary files using the SNSS (Session Storage) format. These files enable Chrome to restore the user's browsing session after a crash or restart.

Session files are forensically valuable because they capture the state of the browser at two points in time: the current session (what was open when Chrome last ran) and the previous session (what was open before the last restart). This provides a snapshot of the user's active browsing context, including pages that may not appear in history (such as pages visited in the current session that have not yet been written to the History database).

File Locations

The "Current" files represent the session that was active when Chrome was last running. The "Last" files represent the session before the most recent restart, preserved during clean shutdown.

Database Schema / File Format

SNSS Binary Format

SNSS files use a custom binary format with the following structure:

SNSS File:
+------------------+
| Magic: "SNSS"    | 4 bytes (ASCII)
+------------------+
| Version: uint32  | 4 bytes (little-endian)
+------------------+
| Command 1        |
|   Size: uint16   | 2 bytes (little-endian)
|   ID: uint8      | 1 byte (command type)
|   Payload: bytes  | (size - 1) bytes
+------------------+
| Command 2        |
|   ...            |
+------------------+
| ...              |
+------------------+

Each file begins with the 4-byte ASCII magic string SNSS followed by a 32-bit version number. The remainder consists of variable-length commands, each prefixed by a 16-bit size field.

Command Types

Navigation Entries

Each tab contains navigation entries representing its back/forward history. These entries include:

• URL
• Page title
• Transition type (same bitmask format as History database)
• Referrer URL
• Timestamp (WebKit format)
• HTTP status code
• Whether the page was loaded via POST
• Redirect chain information

Key Fields for Analysis

Window Records

• window_id: Chrome's internal window identifier.
• window_type: The type of window -- normal, popup, app, or devtools. Popup and devtools windows may indicate specific activities.
• selected_tab_index: Which tab was active (focused) in the window.
• tab_count: Number of tabs in the window.
• is_closed: Whether the window was closed during the session.
• close_time: Timestamp of window closure (if applicable).

Tab Records

• tab_id: Chrome's internal tab identifier.
• window_id: The parent window.
• tab_index: Position within the window's tab bar.
• url: The current page URL.
• title: The current page title.
• pinned: Whether the tab was pinned.
• tab_group_id: UUID of the tab group (if grouped).
• navigation_index: Current position in back/forward history.
• navigation_count: Total entries in back/forward history.
• is_closed / close_time: Tab closure status and timing.

Navigation Records

• url: The URL for this history entry.
• title: Page title.
• transition_type: How the user navigated to this page.
• referrer_url: The referring page URL.
• timestamp: Visit timestamp (WebKit format).
• http_status_code: HTTP response status.
• has_post_data: Whether the page was loaded via a POST request (e.g., form submission).

Timestamps

Analysis Notes

• Session files capture the browser state at a specific moment. Current Session reflects the last known state when Chrome was running. Last Session preserves the state before the most recent Chrome restart.
• Tab navigation history in session files provides back/forward button history that may include pages not yet committed to the History database, especially if Chrome crashed.
• Closed tabs and windows are still recorded in the session file with is_closed = true and a close timestamp. This allows reconstruction of which tabs were closed and when.
• The Current Session file is written to incrementally while Chrome runs. The Last Session file is a complete snapshot created at startup.
• Tab groups (Chrome 85+) with their names and colours provide context for how the user organised their browsing.
• Pinned tabs indicate persistent sites the user keeps open, often email, messaging, or work applications.
• The HTTP status codes in navigation entries can reveal server errors (5xx), authentication requirements (401/403), or redirects (301/302) encountered during browsing.
• POST data indicators (has_post_data = true) suggest form submissions, potentially including login attempts or data submissions.

Version Differences

The SNSS format has remained backward-compatible, with new command types added over time. Unknown commands are safely skipped during parsing.

Tool Support

References

• Chromium Session Backend Source
• Chromium Session Commands
• SNSS File Format Research