Thread by @inversecos

1\ #DFIR: Chrome Forensics - How to Recover CLEARED History

If a user just cleared their browser history, you can still recover everything they were just looking at from the session files:

%appdata%\Local\Google\Chrome\User Data\Default\Sessions

inversecos.com/2022/10/recove…

2\ In some instances (more on this) the session and tab files inside that folder show the webkit/chrome date for when the session was exited.

This allowed me to put together a full timeline of what this naughty boy was doing *BONK*

3\ Historically, evidence of cleared history was in the Favicons file, but this is INCONSISTENT. Specifically under the table named "icon_mapping".

%appdata%\Local\Google\Chrome\User Data\Default\Favicons

4\ Some evidence of deleted searches are stored in “global-entities_metadata” - Chrome’s way of optimising search.

I don't recommend this artefact!

%appdata%\Local\Google\Chrome\User Data\Default optimization_guide_prediction_model_downloads/<str>/global-entities_metadata

5\ Evidence of data being cleared was also historically pulled from the Chrome Preferences file:

%appdata%\Local\Google\Chrome\User Data\Default\Preferences

Under the "browser.last_clear_browsing_data_time"
But this is not a thing anymore.

6\ There are three forensic scenarios I cover in the blog, all with diff artefacts:

1. A user cleared their history and did not use Chrome since

2. A user clears their history and re-opened ONE new session

3. A user clears their history and re-opened several sessions since

7\ Add me on battlenet if you want to play OVERWATCH with me. My username is animeb00bs#1424.
ill blame my bad gameplay on YOU. obviously