Skip to content

Commit e24555d

Browse files
AndrewRathbunAndrewRathbun
authored
Merge pull request EricZimmerman#1079 from reece394/master
Adds Chromium and Dev, Beta and Canary Versions of Edge and Chrome to Targets
2 parents f8945be + 552f59e commit e24555d

15 files changed

Lines changed: 1788 additions & 25 deletions

‎Targets/Browsers/BrowserCache.tkape‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Description: Browser Caches
2-
Author: Bjorn Vanhaeren
3-
Version: 1.1
2+
Author: Bjorn Vanhaeren, Reece394
3+
Version: 1.2
44
Id: bbb89525-6b8d-41f6-acdf-a4f513455703
55
RecreateDirectories: true
66
Targets:
@@ -9,11 +9,46 @@ Targets:
99
Category: Communications
1010
Path: C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Cache\
1111
Recursive: true
12+
-
13+
Name: Chrome Beta Cache Folder
14+
Category: Communications
15+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\Cache\
16+
Recursive: true
17+
-
18+
Name: Chrome Dev Cache Folder
19+
Category: Communications
20+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Dev\User Data\*\Cache\
21+
Recursive: true
22+
-
23+
Name: Chrome SxS - Canary Cache Folder
24+
Category: Communications
25+
Path: C:\Users\%user%\AppData\Local\Google\Chrome SxS\User Data\*\Cache\
26+
Recursive: true
1227
-
1328
Name: Chromium Edge Cache Folder
1429
Category: Communications
1530
Path: C:\Users\%user%\AppData\Local\Microsoft\Edge\User Data\*\Cache\
1631
Recursive: true
32+
-
33+
Name: Chromium Edge Beta Cache Folder
34+
Category: Communications
35+
Path: C:\Users\%user%\AppData\Local\Microsoft\Edge Beta\User Data\*\Cache\
36+
Recursive: true
37+
-
38+
Name: Chromium Edge Dev Cache Folder
39+
Category: Communications
40+
Path: C:\Users\%user%\AppData\Local\Microsoft\Edge Dev\User Data\*\Cache\
41+
Recursive: true
42+
-
43+
Name: Chromium Edge SxS - Canary Cache Folder
44+
Category: Communications
45+
Path: C:\Users\%user%\AppData\Local\Microsoft\Edge SxS\User Data\*\Cache\
46+
Recursive: true
47+
-
48+
Name: Chromium Cache Folder
49+
Category: Communications
50+
Path: C:\Users\%user%\AppData\Local\Chromium\User Data\*\Cache\
51+
Recursive: true
1752
-
1853
Name: Firefox Cache Folder
1954
Category: Communications

‎Targets/Browsers/ChromeBeta.tkape‎

Lines changed: 260 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,260 @@
1+
Description: Chrome Beta
2+
Author: Eric Zimmerman, Andrew Rathbun, Hernan Filannino, Reece394
3+
Version: 1.0
4+
Id: d9c53f6d-d938-4597-9955-b38694c1fe6e
5+
RecreateDirectories: true
6+
Targets:
7+
-
8+
Name: Chrome Beta Bookmarks XP
9+
Category: Communications
10+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
11+
FileMask: Bookmarks*
12+
-
13+
Name: Chrome Beta Cookies XP
14+
Category: Communications
15+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
16+
FileMask: Cookies*
17+
-
18+
Name: Chrome Beta Current Session XP
19+
Category: Communications
20+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
21+
FileMask: Current Session
22+
-
23+
Name: Chrome Beta Current Tabs XP
24+
Category: Communications
25+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
26+
FileMask: Current Tabs
27+
-
28+
Name: Chrome Beta Favicons XP
29+
Category: Communications
30+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
31+
FileMask: Favicons*
32+
-
33+
Name: Chrome Beta History XP
34+
Category: Communications
35+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
36+
FileMask: History*
37+
-
38+
Name: Chrome Beta Last Session XP
39+
Category: Communications
40+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
41+
FileMask: Last Session
42+
-
43+
Name: Chrome Beta Last Tabs XP
44+
Category: Communications
45+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
46+
FileMask: Last Tabs
47+
-
48+
Name: Chrome Beta Login Data XP
49+
Category: Communications
50+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
51+
FileMask: Login Data
52+
-
53+
Name: Chrome Beta Preferences XP
54+
Category: Communications
55+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
56+
FileMask: Preferences
57+
-
58+
Name: Chrome Beta Shortcuts XP
59+
Category: Communications
60+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
61+
FileMask: Shortcuts*
62+
-
63+
Name: Chrome Beta Top Sites XP
64+
Category: Communications
65+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
66+
FileMask: Top Sites*
67+
-
68+
Name: Chrome Beta Visited Links XP
69+
Category: Communications
70+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
71+
FileMask: Visited Links
72+
-
73+
Name: Chrome Beta Web Data XP
74+
Category: Communications
75+
Path: C:\Documents and Settings\%user%\Local Settings\Application Data\Google\Chrome Beta\User Data\*\
76+
FileMask: Web Data*
77+
-
78+
Name: Chrome Beta Bookmarks
79+
Category: Communications
80+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
81+
FileMask: Bookmarks*
82+
-
83+
Name: Chrome Beta Cookies
84+
Category: Communications
85+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
86+
Recursive: true
87+
FileMask: Cookies*
88+
-
89+
Name: Chrome Beta Current Session
90+
Category: Communications
91+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
92+
FileMask: Current Session
93+
-
94+
Name: Chrome Beta Current Tabs
95+
Category: Communications
96+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
97+
FileMask: Current Tabs
98+
-
99+
Name: Chrome Beta Download Metadata
100+
Category: Communications
101+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
102+
FileMask: DownloadMetadata
103+
-
104+
Name: Chrome Beta Extension Cookies
105+
Category: Communications
106+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
107+
FileMask: Extension Cookies*
108+
-
109+
Name: Chrome Beta Favicons
110+
Category: Communications
111+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
112+
FileMask: Favicons*
113+
-
114+
Name: Chrome Beta History
115+
Category: Communications
116+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
117+
FileMask: History*
118+
-
119+
Name: Chrome Beta Last Session
120+
Category: Communications
121+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
122+
FileMask: Last Session
123+
-
124+
Name: Chrome Beta Last Tabs
125+
Category: Communications
126+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
127+
FileMask: Last Tabs
128+
-
129+
Name: Chrome Beta Sessions Folder
130+
Category: Communications
131+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\Sessions\
132+
Recursive: false
133+
-
134+
Name: Chrome Beta Login Data
135+
Category: Communications
136+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
137+
FileMask: Login Data*
138+
-
139+
Name: Chrome Beta Media History
140+
Category: Communications
141+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
142+
FileMask: Media History*
143+
-
144+
Name: Chrome Beta Network Action Predictor
145+
Category: Communications
146+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
147+
FileMask: Network Action Predictor*
148+
-
149+
Name: Chrome Beta Network Persistent State
150+
Category: Communications
151+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
152+
FileMask: Network Persistent State
153+
-
154+
Name: Chrome Beta Network Persistent State
155+
Category: Communications
156+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\Network
157+
FileMask: Network Persistent State
158+
-
159+
Name: Chrome Beta Preferences
160+
Category: Communications
161+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
162+
FileMask: Preferences
163+
-
164+
Name: Chrome Beta Quota Manager
165+
Category: Communications
166+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
167+
FileMask: QuotaManager*
168+
-
169+
Name: Chrome Beta Quota Manager
170+
Category: Communications
171+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\WebStorage
172+
FileMask: QuotaManager*
173+
-
174+
Name: Chrome Beta Reporting and NEL
175+
Category: Communications
176+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
177+
FileMask: Reporting and NEL*
178+
-
179+
Name: Chrome Beta Reporting and NEL
180+
Category: Communications
181+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\Network
182+
FileMask: Reporting and NEL*
183+
-
184+
Name: Chrome Beta Shortcuts
185+
Category: Communications
186+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
187+
FileMask: Shortcuts*
188+
-
189+
Name: Chrome Beta Top Sites
190+
Category: Communications
191+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
192+
FileMask: Top Sites*
193+
-
194+
Name: Chrome Beta Trust Tokens
195+
Category: Communications
196+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
197+
FileMask: Trust Tokens*
198+
-
199+
Name: Chrome Beta Trust Tokens
200+
Category: Communications
201+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\Network
202+
FileMask: Trust Tokens*
203+
-
204+
Name: Chrome Beta SyncData Database
205+
Category: Communications
206+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\Sync Data
207+
FileMask: SyncData.sqlite3
208+
-
209+
Name: Chrome Beta Visited Links
210+
Category: Communications
211+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
212+
FileMask: Visited Links
213+
-
214+
Name: Chrome Beta Web Data
215+
Category: Communications
216+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\
217+
FileMask: Web Data*
218+
-
219+
Name: Chrome Beta IndexedDB
220+
Category: Communications
221+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\IndexedDB\
222+
Recursive: true
223+
Comment: "Collects IndexedDB (LevelDB) databases used by modern web applications to store data."
224+
-
225+
Name: Chrome Beta Local Storage
226+
Category: Communications
227+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\*\Local Storage\leveldb\
228+
Recursive: true
229+
Comment: "Collects Local Storage (LevelDB) databases, another form of persistent client-side storage."
230+
-
231+
Name: Windows Protect Folder
232+
Category: FileSystem
233+
Path: C:\Users\%user%\AppData\Roaming\Microsoft\Protect\*\
234+
Recursive: true
235+
Comment: "Required for offline decryption"
236+
-
237+
Name: Chrome Beta Snapshots Folder
238+
Category: Communications
239+
Path: C:\Users\%user%\AppData\Local\Google\Chrome Beta\User Data\Snapshots\*\
240+
Recursive: true
241+
Comment: "Grabs folder that appears to have snapshots of Chrome SQLite DBs organized by version #."
242+
-
243+
Name: SYSTEM Chrome Beta History
244+
Category: Communications
245+
Path: C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome Beta\User Data\*\
246+
FileMask: History*
247+
248+
# Documentation
249+
# https://nasbench.medium.com/web-browsers-forensics-7e99940c579a
250+
# https://www.digitalforensics.com/blog/an-overview-of-web-browser-forensics/
251+
# https://www.sans.org/blog/google-chrome-forensics/
252+
# http://cyberforensicator.com/wp-content/uploads/2017/02/20160919.pdf
253+
# https://forensicswiki.xyz/wiki/index.php?title=Google_Chrome
254+
# https://dfir.blog/chrome-values-lookup-tables/
255+
# https://www.sans.org/blog/forensically-mining-new-nuggets-of-google-chrome/
256+
# https://digitalinvestigation.wordpress.com/tag/snss/
257+
# https://dfir.blog/cookies-database-moving-in-chrome-96/
258+
# https://www.forensafe.com/blogs/googlechrome.html
259+
# The SQLite database(s) this Target collects can be parsed with SQLECmd using the following map(s): https://github.com/EricZimmerman/SQLECmd/blob/master/SQLMap/Maps/Windows_Chrome_History.smap
260+
# For the files that aren't JSON or SQlite, aka Current Session, Current Tabs, Last Tabs, Last Session, see above links for clues on how to interpret that data

0 commit comments

Comments
 (0)