Google also offers Chromium as an open source framework that many other third-party browsers use as a back-end. Beyond the history, cache, bookmarks, and cookies you’ll find with most browsers, Google Chrome stores sync data, tab/session data, login information, as well as many other sources of evidence that may be useful to examiners.
The history is typically stored in SQLite databases under the user’s AppData folder in Windows and uses a similar format for both iOS and Android. Like most browsers, Chrome stores much of its history data in a database, while storing cache data such as pictures, webpages, scripts, cookies, etc. It is available for all major platforms and it is very likely examiners willl come across Chrome in one of their investigations, if not most of them. With 65.9% of all browser usage in September 2015, Google Chrome is the most popular browser used today. Windows – %root%\Users\%username%\AppData\Local\Google\Chrome\User Data\DefaultĪndroid – data\data\\app_chrome\Default iOS – %root%\Library\Application Support\Google\Chrome\Default
RELATED ARTIFACTS: Chrome Web History, Chrome Web Visits, Chrome Sync Data, Chrome Sync Accounts, Chrome Session/Tabs Carved, Chrome Last Tabs, Chrome Current Tabs, Chrome Last Session, Chrome Current Session, Chrome Top Sites, Chrome Logins, Chrome Searches, Chrome Keyword Search Terms, Chrome History Index, Chrome FavIcons, Chrome Downloads, Chrome Cookies, Chrome Cache Records, Chrome Bookmarks, Chrome Archived Web History, Chrome Archived Keyword Search Terms, Chrome Autofil, Chrome Autofil Profiles, Chrome Saved Credit Cards