Google Chrome Forensic Analysis: An Ultimate Path For Evidence Collection

Simon | October 17th, 2015 | Forensics

It is a common and well known fact that the number of web users has increased nowadays. People spends their whole day infront of the computer and this clearly marks that large about of information will be there in the files related to the browsing. As since now many of the criminal activities are done with the help of information available in web, searching the browser file has become the important part of investigation. Or in other words, it is said that illegal activities are carried out with the help of web. Because of these, Google Chrome forensic analysis to examine files related to web become important. There are different browsers available for the users to surf over the web such as, Firefox, Chrome, Yahoo etc. Here, in this page you will get to know about how to collect artifacts from Google Chrome. The discussion covers all the related topics from where one can get the details.

Some of the areas in Google Chrome browser forensics that help investigators are as listed;

  • History
  • Cache
  • Cookies
  • Bookmarks
  • Session restore file
  • Current tabs
  • Last session

Let us start the evidence collection from ‘History’. But, where are the Chrome files located.





During Google Chrome forensic analysis, in the ‘History’, you will get to see all the sites visited so far and all the files follows Sqlite database file format.

Location of History:

In Windows XP


In Vista/7/8 and above;


Google Chrome Browser Forensics

From the ‘History’ file, you can view the ‘URLs’, ‘downloads’ and ‘visits’. It reveals the URLs visited, downloads made and the table of ‘visits lists the timestamps and type of visits thus, aids to the information collection easily.


In Google Chrome forensic analysis; Cache is the inevitable part since it contains the actual content of the message.


In Windows XP


Vista and above;



Cookie stores the cookie information of the visited sites, includes site name, last time of the access of the cookie etc. Cookies are stored with ‘Cookies’ in Chrome and those cookies used with extension are stored in file called ‘Extension Cookies’.

Location of Cookies in Google Chrome forensic analysis;

Vista or Windows 7 or/and above;


In Windows XP


Google Chrome Browser Forensics

Where Does The Password Get Stored?

Apart from the history, cache, cookies etc., Chrome stores the login details in ‘Web Data’ file which is now replaced by ‘Login Data’ file. Moreover, the file stores IE7 Logins, auto complete entries, search keywords etc. Except the password, all the others are stored in text and passwords are encrypted by Triple DES algorithm.

In Vista and above Windows version, the location of ‘Login Data’ is;


Google Chrome Forensic Analysis



The location of database files is;

Windows XP


Vista and later


What More Can Be Seen?

While conducting Google Chrome browser forensics; for more probe, you can visit the sessions such as, Current Sessions, Current Tabs, Last Session and Last Tabs.

Google Chrome Browser Forensics

From the name of the files itself users will get to know about the use of the file. The last session file helps the users or the investigators to restore the last browsed session when the browser is opened up. While carrying out Google Chrome forensic analysis, these files are the way to collect the information regarding the opened tabs, about the sites exhibited etc.


The bookmark specified by the users, if any will be stored in the ‘bookmarks’ and the file is located in;

Windows XP




With a thorough search over the Chrome files, an investigator can get the evidence for closing the case, if any. For a trained agent, finding the artifacts will be easier and now there are even tools available in the market to help in finding the evidence from these files. During Google Chrome browser forensics; if the locations are clear, one can find information easier. Hope this page has added some valuable information.