dark
Trending Top-Read Articles
Trending Tags
5 shares
0
0
5
0
0
0
4 minute read

Chrome forensic with python

Abdul Wahab Junaid
December 27, 2023
Chrome forensic with python
Total
5
Shares
0
0
5
0
0
0
0
0

Chrome forensics using Python, incorporating best practices and addressing potential issues:

Key Libraries and Tools:

  • Hindsight:
    • Versatile open-source tool for parsing a wide range of Chrome artifacts.
    • Extracts and interprets data like URLs, download history, cache records, bookmarks, cookies, local storage, and more.
    • Extensible with plugins for custom analysis.
    • Installation: pip install pyhindsight
  • SQLite:
    • Python library for working with SQLite databases, which Chrome uses to store various data.
    • Enables direct interaction with databases for custom queries and analysis.
  • ChromeCacheView:
    • External tool (not Python-based) for viewing and analyzing cached files from Chrome.
    • Useful for examining cached web content.

General Process:

  1. Identify Chrome Profile Location:
    • Windows: %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default
    • macOS: ~/Library/Application Support/Google/Chrome/Default
    • Linux: ~/.config/google-chrome/Default
  2. Choose Appropriate Tool/Method:
    • Hindsight: Comprehensive parsing and analysis.
    • SQLite: Manual inspection and querying of specific databases.
    • ChromeCacheView: Focused analysis of cached files.
  3. Analyze Artifacts:
    • Examine extracted data using Python’s data structures and libraries (e.g., Pandas for tabular data).
    • Tailor analysis to specific investigative needs.

Specific Examples:

  • History:
    • Using Hindsight: hindsight.py --history chrome_history
    • Using SQLite: Access the History database and query tables like urls and visits.
  • Downloads:
    • Using Hindsight: hindsight.py --downloads chrome_history
    • Using SQLite: Access the History database and query the downloads table.
  • Cache:
    • Using SQLite: Access the Cache database and query tables like cache_data.
    • Using ChromeCacheView: Open the Cache folder and view cached files.

Essential Considerations:

  • Privacy and Ethics: Ensure legal and ethical compliance when conducting forensic investigations.
  • Chrome Version Updates: Stay updated with changes in Chrome’s data structures and formats.
  • Database Integrity: Verify database integrity before analysis to avoid errors or misinterpretations.
  • Data Encryption: Decrypt sensitive data if necessary (e.g., passwords).
  • Expertise: Seek guidance from experienced digital forensics professionals for complex cases or legal implications.

Extract metadata information from the Google Chrome download history database

Python
#!usr/bin/env python3

import sqlite3
import datetime
import optparse

def fixDate(timestamp):
    #Chrome stores timestamps in the number of microseconds since Jan 1 1601.
    #To convert, we create a datetime object for Jan 1 1601...
    epoch_start = datetime.datetime(1601,1,1)
    #create an object for the number of microseconds in the timestamp
    delta = datetime.timedelta(microseconds=int(timestamp))
    #and return the sum of the two.
    return epoch_start + delta

def getMetadataHistoryFile(locationHistoryFile):
	sql_connect = sqlite3.connect(locationHistoryFile)
	for row in sql_connect.execute('SELECT target_path, referrer, start_time, end_time, received_bytes FROM downloads;'):
		print ("Download:",row[0].encode('utf-8'))
		print ("\tFrom:",str(row[1]))
		print ("\tStarted:",str(fixDate(row[2])))
		print ("\tFinished:",str(fixDate(row[3])))
		print ("\tSize:",str(row[4]))
	
def main():
    parser = optparse.OptionParser('--location ')
    parser.add_option('--location', dest='location', type='string', help='specify target location')
    (options, args) = parser.parse_args()
    location = options.location
    getMetadataHistoryFile(location)

if __name__ == '__main__':
    main()

This Python script is designed to extract metadata information from the Google Chrome download history database. The script connects to the specified SQLite database (which stores Chrome download history) and retrieves details such as the target path, referrer, start time, end time, and received bytes for each download entry. Below is an explanation of the code:

Explanation:

  1. fixDate Function:

    • Converts Chrome timestamps (in microseconds since Jan 1, 1601) to a human-readable datetime format.
    • Takes a timestamp as input and returns a datetime object.

  2. getMetadataHistoryFile Function:

    • Connects to the SQLite database specified by the locationHistoryFile parameter.
    • Executes a query to retrieve download metadata from the downloads table.
    • Prints information such as target path, referrer, start time, end time, and received bytes for each download entry.

  3. main Function:

    • Uses the optparse module to parse command-line options.
    • Calls the getMetadataHistoryFile function with the specified target location.

  4. Command-Line Usage:

    • The script expects the user to provide the target location as a command-line argument using the --location option.

  5. if __name__ == '__main__': Block:

    • Calls the main function when the script is executed directly.

Note: Ensure you have the necessary permissions to access and analyze the specified Chrome download history database. Additionally, adapt the script to the specific paths and structure of your Chrome data on your system.

Chrome forensics with Hindsight

Hindsight is a great open-source tool for performing Chrome forensics with Python. Here’s a detailed breakdown of using Hindsight effectively:

Getting Started:

  1. Installation: Install Hindsight through pip: pip install pyhindsight
  2. Download the Tool: You can find the latest release on GitHub: https://github.com/obsidianforensics/hindsight/releases
  3. Locate Chrome Profiles: Identify the directory containing your target user’s Chrome profiles. Default locations differ for Windows, macOS, and Linux. (Refer to my previous response for specific paths)

Basic Commands:

  • View Profile Information: hindsight.py info
  • Parse All Artifacts: hindsight.py all
  • Analyze Specific Artifacts:
    • History: hindsight.py --history
    • Downloads: hindsight.py --downloads
    • Bookmarks: hindsight.py --bookmarks
    • Cookies: hindsight.py --cookies
    • Local Storage: hindsight.py --local_storage
    • Extensions: hindsight.py --extensions
    • And more (check Hindsight documentation for full list)

Advanced Usage:

  • Output Formats: Save results in various formats like CSV, JSON, or SQL for further analysis with other tools.
  • Filtering and Searching: Use flags like --filter and --search to focus on specific data points.
  • Custom Plugins: Hindsight supports custom plugins for analyzing specific data types or extracting unique information.
  • Web Interface: Run hindsight_gui.py or hindsight_gui.exe to access a user-friendly web interface for visualizing results.

Additional Resources:

Remember:

  • Always handle sensitive data with care and comply with relevant legal and ethical considerations.
  • Hindsight is just one tool in a digital forensics arsenal. Combine it with other techniques and expertise for comprehensive investigations.

I hope this information helps you get started with Chrome forensics using Hindsight! Feel free to ask if you have any further questions about specific tasks or functionalities.

Share 0
Tweet 0
Total
5
Shares
Share 0
Tweet 0
Pin it 5
Share 0
Share 0
Like 0
Share 0

Leave a Reply

Previous Post
Extracting Geo-location and Metadata from Documents, Images, and Browsers

Extracting Geo-location and Metadata from Documents, Images, and Browsers

December 27, 2023
Next Post
Encrypting and encrypting information with pycryptodome

Encrypting and encrypting information with pycryptodome

December 27, 2023
Related Posts