# Web browser artifacts.

name: BrowserCache
doc: Web browser cache of multiple web browsers.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'ChromeCache'
    - 'FirefoxCache'
    - 'InternetExplorerCache'
    - 'SafariCache'
labels: [Browser]
supported_os: [Darwin,Linux,Windows]
---
name: BrowserHistory
doc: Web browser history of multiple web browsers.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'ChromeHistory'
    - 'FirefoxHistory'
    - 'InternetExplorerHistory'
    - 'OperaHistory'
    - 'SafariDownloads'
    - 'SafariHistory'
labels: [Browser]
supported_os: [Darwin,Linux,Windows]
---
name: ChromeStorage
doc: |
  Google Chrome, Canary and Chromium browser artifacts for Storage APIs.

  Includes Web Storage (sessionStorage for session-only data and
  localStorage for persistent data), IndexedDB (used for structured data),
  and FileSystem (object storage in a virtual file system).

sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'ChromeLocalStorage'
    - 'ChromeSessionStorage'
    - 'ChromeFileSystem'
    - 'ChromeIndexedDB'
labels: [Browser]
supported_os: [Darwin,Linux,Windows]
urls:
- 'https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API'
- 'https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API'
- 'https://developer.mozilla.org/en-US/docs/Web/API/FileSystem'
---
name: ChromeCache
doc: |
  Google Chrome, Canary and Chromium browser caches.

  Canary uses "Chrome SxS" on windows.

  * Disk cache (or Cache)
  * Media cache
  * Application cache
  * GPU shader cache
  * PNaCl translation cache
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Application Cache\Cache\*'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Cache\*'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Media Cache\*'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\GPUCache\*'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Application Cache\Cache\*'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Cache\*'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Media Cache\*'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\GPUCache\*'
    - '%%users.localappdata%%\Chromium\User Data\*\Application Cache\Cache\*'
    - '%%users.localappdata%%\Chromium\User Data\*\Cache\*'
    - '%%users.localappdata%%\Chromium\User Data\*\Media Cache\*'
    - '%%users.localappdata%%\Chromium\User Data\*\GPUCache\*'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Caches/Google/Chrome/*/Cache/*'
    - '%%users.homedir%%/Library/Caches/Google/Chrome/*/Cache/*'
    - '%%users.homedir%%/Library/Caches/Google/Chrome/*/Media Cache/*'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Application Cache/Cache/*'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/GPUCache/*'
    - '%%users.homedir%%/Library/Caches/Google/Chrome/PnaclTranslationCache/*'
    - '%%users.homedir%%/Caches/Google/Chrome Canary/*/Cache/*'
    - '%%users.homedir%%/Library/Caches/Google/Chrome Canary/*/Cache/*'
    - '%%users.homedir%%/Library/Caches/Google/Chrome Canary/*/Media Cache/*'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Application Cache/Cache/*'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/GPUCache/*'
    - '%%users.homedir%%/Library/Caches/Google/Chrome Canary/PnaclTranslationCache/*'
    - '%%users.homedir%%/Caches/Chromium/*/Cache/*'
    - '%%users.homedir%%/Library/Caches/Chromium/*/Cache/*'
    - '%%users.homedir%%/Library/Caches/Chromium/*/Media Cache/*'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Application Cache/Cache/*'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/GPUCache/*'
    - '%%users.homedir%%/Library/Caches/Chromium/PnaclTranslationCache/*'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.cache/google-chrome/Cache/*'
    - '%%users.homedir%%/.cache/google-chrome/*/Cache/*'
    - '%%users.homedir%%/.cache/google-chrome/*/Media Cache/*'
    - '%%users.homedir%%/.cache/google-chrome/PnaclTranslationCache/*'
    - '%%users.homedir%%/.config/google-chrome/*/Application Cache/*'
    - '%%users.homedir%%/.config/google-chrome/*/Cache/*'
    - '%%users.homedir%%/.config/google-chrome/*/Media Cache/*'
    - '%%users.homedir%%/.config/google-chrome/*/GPUCache/*'
    - '%%users.homedir%%/.cache/chromium/Cache/*'
    - '%%users.homedir%%/.cache/chromium/*/Cache/*'
    - '%%users.homedir%%/.cache/chromium/*/Media Cache/*'
    - '%%users.homedir%%/.cache/chromium/PnaclTranslationCache/*'
    - '%%users.homedir%%/.config/chromium/*/Application Cache/*'
    - '%%users.homedir%%/.config/chromium/*/Cache/*'
    - '%%users.homedir%%/.config/chromium/*/Media Cache/*'
    - '%%users.homedir%%/.config/chromium/*/GPUCache/*'
    - '%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/Cache/*'
    - '%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/*/Cache/*'
    - '%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/*/Media Cache/*'
    - '%%users.homedir%%/.cache/chrome-remote-desktop/chrome-profile/PnaclTranslationCache/*'
    - '%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/Cache/*'
    - '%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/*/Cache/*'
    - '%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/*/Media Cache/*'
    - '%%users.homedir%%/.cache/chrome-remote-desktop/chrome-config/google-chrome/PnaclTranslationCache/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Application Cache/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Cache/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Media Cache/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/GPUCache/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Application Cache/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Cache/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Media Cache/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/GPUCache/*'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['https://github.com/ForensicArtifacts/artifacts-kb/blob/master/webbrowser/ChromeCache.md']
---
name: ChromeCookies
doc: Chrome Cookies database.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Chromium\User Data\*\Cookies'
    - '%%users.localappdata%%\Chromium\User Data\*\Cookies-journal'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Cookies'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Cookies-journal'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Cookies'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Cookies-journal'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/google-chrome/*/Cookies'
    - '%%users.homedir%%/.config/google-chrome/*/Cookies-journal'
    - '%%users.homedir%%/.config/chromium/*/Cookies'
    - '%%users.homedir%%/.config/chromium/*/Cookies-journal'
    - '%%users.homedir%%/.config/google-chrome-beta/*/Cookies'
    - '%%users.homedir%%/.config/google-chrome-beta/*/Cookies-journal'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Cookies'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Cookies-journal'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Cookies'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Cookies-journal'
  supported_os: [Linux]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Cookies'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Cookies-journal'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Cookies'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Cookies-journal'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Cookies'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Cookies-journal'
  supported_os: [Darwin]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
---
name: ChromeExtensionActivity
doc: Chrome Extension Activity database.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Extension Activity'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Extension Activity'
    - '%%users.localappdata%%\Chromium\User Data\*\Extension Activity'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Extension Activity'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Extension Activity'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Extension Activity'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/google-chrome/*/Extension Activity'
    - '%%users.homedir%%/.config/chromium/*/Extension Activity'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Google_Chrome#Extension_Activity_database']
---
name: ChromeExtensions
doc: Chrome browser extension files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Extensions\**10'
    - '%%users.localappdata%%\Chromium\User Data\*\Extensions\**10'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Extensions\**10'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Extensions/**10'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Extensions/**10'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Extensions/**10'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/google-chrome/*/Extensions/**10'
    - '%%users.homedir%%/.config/google-chrome-beta/*/Extensions/**10'
    - '%%users.homedir%%/.config/chromium/*/Extensions/**10'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Extensions/**10'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Extensions/**10'
  supported_os: [Linux]
supported_os: [Windows, Darwin, Linux]
labels: [Browser]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Google_Chrome#Extensions']
---
name: ChromeExtensionRegistryKeys
doc: Chrome extensions installed by writing windows registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\**5'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Google\Chrome\Extensions\**5'
labels: [Browser]
supported_os: [Windows]
urls: ['https://developer.chrome.com/extensions/external_extensions#registry']
---
name: ChromeFileSystem
doc: |
  Google Chrome, Canary and Chromium File System files.

  The File System directory backs Chrome's fileSystem API. Inside this
  directory are a mixture of the data files saved using the fileSystem
  API and LevelDB directories that track the logical structure of the
  virtual file system.

sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Chromium\User Data\*\File System\**5'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\File System\**5'
      - '%%users.localappdata%%\Google\Chrome\User Data\*\File System\**5'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/google-chrome/*/File System/**5'
    - '%%users.homedir%%/.config/chromium/*/File System/**5'
    - '%%users.homedir%%/.config/google-chrome-beta/*/File System/**5'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/File System/**5'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/File System/**5'
  supported_os: [Linux]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Chromium/*/File System/**5'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/File System/**5'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/File System/**5'
  supported_os: [Darwin]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls:
- 'https://developer.chrome.com/apps/fileSystem'
- 'https://developer.mozilla.org/en-US/docs/Web/API/FileSystem'
- 'https://dfir.blog/deciphering-browser-hieroglyphics-leveldb-filesystem/'
---
name: ChromeHistory
doc: Chrome browser history.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Chromium\User Data\*\Archived History'
    - '%%users.localappdata%%\Chromium\User Data\*\Archived History-journal'
    - '%%users.localappdata%%\Chromium\User Data\*\History'
    - '%%users.localappdata%%\Chromium\User Data\*\History-journal'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Archived History'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Archived History-journal'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\History'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\History-journal'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Archived History'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Archived History-journal'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\History'
    - '%%users.localappdata%%\Google\Chrome\User Data\*\History-journal'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Archived History'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Archived History-journal'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/History'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/History-journal'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Archived History'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Archived History-journal'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/History'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/History-journal'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Archived History'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Archived History-journal'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/History'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/History-journal'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/chromium/*/Archived History'
    - '%%users.homedir%%/.config/chromium/*/Archived History-journal'
    - '%%users.homedir%%/.config/chromium/*/History'
    - '%%users.homedir%%/.config/chromium/*/History-journal'
    - '%%users.homedir%%/.config/google-chrome/*/Archived History'
    - '%%users.homedir%%/.config/google-chrome/*/Archived History-journal'
    - '%%users.homedir%%/.config/google-chrome/*/History'
    - '%%users.homedir%%/.config/google-chrome/*/History-journal'
    - '%%users.homedir%%/.config/google-chrome-beta/*/Archived History'
    - '%%users.homedir%%/.config/google-chrome-beta/*/Archived History-journal'
    - '%%users.homedir%%/.config/google-chrome-beta/*/History'
    - '%%users.homedir%%/.config/google-chrome-beta/*/History-journal'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Archived History'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Archived History-journal'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/History'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/History-journal'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Archived History'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Archived History-journal'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/History'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/History-journal'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Google_Chrome']
---
name: ChromeIndexedDB
doc: |
  Google Chrome, Canary and Chromium IndexedDB files.

  The IndexedDB directory contains one directory per origin that uses
  IndexedDB, named like https_www.example.com_0.indexeddb.leveldb,
  chrome-extension_app-id-xxx_0.indexeddb.leveldb, or
  https_www.example.com_0.indexeddb.blob. Inside each of the *.leveldb
  directories are the files the comprise a LevelDB database, which in turn
  holds IndexedDB data for that origin. There may be an accompanying .blob
  directory, which contains a nested folder structure of blobs.

sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Chromium\User Data\*\IndexedDB\**5'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\IndexedDB\**5'
      - '%%users.localappdata%%\Google\Chrome\User Data\*\IndexedDB\**5'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/google-chrome/*/IndexedDB/**5'
    - '%%users.homedir%%/.config/chromium/*/IndexedDB/**5'
    - '%%users.homedir%%/.config/google-chrome-beta/*/IndexedDB/**5'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/IndexedDB/**5'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/IndexedDB/**5'
  supported_os: [Linux]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Chromium/*/IndexedDB/**5'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/IndexedDB/**5'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/IndexedDB/**5'
  supported_os: [Darwin]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls:
- 'https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API'
---
name: ChromeLocalStorage
doc: |
  Google Chrome, Canary and Chromium Local Storage files.

  * Chrome v60 and below used individual .sqlite files per origin for Local Storage,
    stored in the Local Storage directory root.
  * In Chrome v61, a leveldb directory was added inside the root Local Storage directory,
    and new origins saved Local Storage data in a single LevelDB there.
  * Existing .sqlite files are kept (not moved to leveldb), so it is possible for a
    single Chrome profile to use both SQLite and LevelDB for Local Storage.

sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Chromium\User Data\*\Local Storage\**'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Local Storage\**'
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Local Storage\**'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/google-chrome/*/Local Storage/**'
    - '%%users.homedir%%/.config/chromium/*/Local Storage/**'
    - '%%users.homedir%%/.config/google-chrome-beta/*/Local Storage/**'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Local Storage/**'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Local Storage/**'
  supported_os: [Linux]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Local Storage/**'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Local Storage/**'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Local Storage/**'
  supported_os: [Darwin]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
---
name: ChromePreferences
doc: Chrome Preferences file.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Google\Chrome\User Data\*\Preferences'
    - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Preferences'
    - '%%users.localappdata%%\Chromium\User Data\*\Preferences'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Preferences'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Preferences'
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Preferences'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/google-chrome/*/Preferences'
    - '%%users.homedir%%/.config/chromium/*/Preferences'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Preferences'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Preferences'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Google_Chrome#Configuration']
---
name: ChromeSessionStorage
doc: |
  Google Chrome, Canary and Chromium Session Storage files.

  The Session Storage directory contains the files that comprise a LevelDB
  database, which in turn holds the Session Storage data.

sources:
- type: FILE
  attributes:
    paths:
      - '%%users.localappdata%%\Chromium\User Data\*\Session Storage\*'
      - '%%users.localappdata%%\Google\Chrome SxS\User Data\*\Session Storage\*'
      - '%%users.localappdata%%\Google\Chrome\User Data\*\Session Storage\*'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.config/google-chrome/*/Session Storage/*'
    - '%%users.homedir%%/.config/chromium/*/Session Storage/*'
    - '%%users.homedir%%/.config/google-chrome-beta/*/Session Storage/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-profile/*/Session Storage/*'
    - '%%users.homedir%%/.config/chrome-remote-desktop/chrome-config/google-chrome/*/Session Storage/*'
  supported_os: [Linux]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Chromium/*/Session Storage/*'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome Canary/*/Session Storage/*'
    - '%%users.homedir%%/Library/Application Support/Google/Chrome/*/Session Storage/*'
  supported_os: [Darwin]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
---
name: FirefoxCache
doc: Mozilla Firefox browser caches.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*.default\Cache\*'
    - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*.default\cache2\*'
    - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*.default\cache2\doomed\*'
    - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*.default\cache2\entries\*'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/Cache/*'
    - '%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/*'
    - '%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/doomed/*'
    - '%%users.homedir%%/Library/Caches/Firefox/Profiles/*.default/cache2/entries/*'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.mozilla/firefox/*.default/Cache/*'
    - '%%users.homedir%%/.cache/mozilla/firefox/*.default/Cache/*'
    - '%%users.homedir%%/.cache/mozilla/firefox/*.default/cache2/*'
    - '%%users.homedir%%/.cache/mozilla/firefox/*.default/cache2/doomed/*'
    - '%%users.homedir%%/.cache/mozilla/firefox/*.default/cache2/entries/*'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['https://github.com/ForensicArtifacts/artifacts-kb/blob/master/webbrowser/FirefoxCache.md']
---
name: FirefoxHistory
doc: Firefox browser history (places.sqlite).
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*\places.sqlite'
    - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*\places.sqlite-wal'
    - '%%users.appdata%%\Mozilla\Firefox\Profiles\*\places.sqlite'
    - '%%users.localappdata%%\Mozilla\Firefox\Profiles\*\places.sqlite-wal'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/places.sqlite'
    - '%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/places.sqlite-wal'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.mozilla/firefox/*/places.sqlite'
    - '%%users.homedir%%/.mozilla/firefox/*/places.sqlite-wal'
  supported_os: [Linux]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Mozilla_Firefox']
---
name: InternetExplorerBrowserHelperObjects
doc: Loaded on Internet Explorer startup
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
- 'https://code.google.com/p/regripper/wiki/ASEPs'
---
name: InternetExplorerCache
doc: |
  Microsoft Internet Explorer (MSIE) browser cache.

  * MSIE 4 - 9 Temporary Internet files.
  * MSIE 10 INetCache files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Content.IE5\*\*'
    - '%%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\*\*'
    - '%%users.localappdata%%\Microsoft\Windows\INetCache\IE\*\*'
    - '%%users.localappdata%%\Microsoft\Windows\INetCache\Low\*\*'
    separator: '\'
labels: [Browser]
supported_os: [Windows]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Internet_Explorer']
---
name: InternetExplorerCookies
doc: |
  Microsoft Internet Explorer (MSIE) browser cookies.

  * MSIE 4 - 9 Cache files (index.dat)
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.appdata%%\Microsoft\Windows\Cookies\index.dat'
    - '%%users.appdata%%\Microsoft\Windows\Cookies\Low\index.dat'
    separator: '\'
labels: [Browser]
supported_os: [Windows]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Internet_Explorer']
---
name: InternetExplorerHistory
doc: |
  Microsoft Internet Explorer (MSIE) browser history.

  * MSIE 4 - 9 Cache files (index.dat);
  * MSIE 10 WebCacheV*.dat files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.appdata%%\Microsoft\Windows\IEDownloadHistory\index.dat'
    - '%%users.localappdata%%\Microsoft\Feeds Cache\index.dat'
    - '%%users.localappdata%%\Microsoft\Windows\History\History.IE5\*\index.dat'
    - '%%users.localappdata%%\Microsoft\Windows\History\History.IE5\index.dat'
    - '%%users.localappdata%%\Microsoft\Windows\History\Low\History.IE5\*\index.dat'
    - '%%users.localappdata%%\Microsoft\Windows\History\Low\History.IE5\index.dat'
    - '%%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat'
    - '%%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat'
    - '%%users.localappdata%%\Microsoft\Windows\WebCache\WebCacheV*.dat'
    - '%%users.userprofile%%\Local Settings\History\History.IE5\index.dat'
    separator: '\'
labels: [Browser]
supported_os: [Windows]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Internet_Explorer']
---
name: InternetExplorerProtectedModeElevationPolicies
doc: |
  Trust levels of apps launched from low rights IE sessions.

  The ElevationPolicy dictates how IE handles applications that want to execute
  in other applications that reside outside of the Low Rights IE session.

  * AppName is the executable
  * AppPath is the directory
  * CLSID is used if it launches a COM server through CoCreateInstance
  * Policy (DWORD) is the trust level, of 0 through 3.

  * 3 Protected Mode silently launches the broker as a medium integrity process.
  * 2 Protected Mode prompts the user for permission to launch the process. If
      permission is granted, the process is launched as a medium integrity process.
  * 1 Protected Mode silently launches the broker as a low integrity process.
  * 0 Protected Mode prevents the process from launching.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'Policy'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'AppName'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'AppPath'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'CLSID'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'Policy'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'AppName'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'AppPath'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\*', value: 'CLSID'}
labels: [Browser]
supported_os: [Windows]
urls:
 - 'http://blogs.technet.com/b/juanand/archive/2010/10/29/internet-explorer-protected-mode-elevation-policy-and-administrative-templates.aspx'
 - 'https://msdn.microsoft.com/en-us/library/bb250462(VS.85).aspx'
---
name: InternetExplorerProtectedModeDisable
doc: |
  Microsoft Internet Explorer (MSIE) Protected Mode Banner can be suppressed
  by setting NoProtectedModeBanner.

  * Applies to versions 7-11
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner']}
labels: [Browser]
supported_os: [Windows]
urls: ['http://www.blackforce.co.uk/2014/01/07/disable-protected-mode-is-turned-off-for-the-internet-zone-group-policy']
---
name: InternetExplorer6Settings
doc: Registry keys affecting default behavior for Microsoft Internet Explorer 6.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'AboutURLs'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'UrlSearchHooks'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'Extensions'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'ExplorerBars'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'Toolbar'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer', value: 'SearchURL'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Default_Page_URL'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Default_Search_URL'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Search Page'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Start Page'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main', value: 'Search Bar'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search', value: 'CustomizeSearch'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'UrlSearchHooks'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'Extensions'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'ExplorerBars'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'Toolbar'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer', value: 'SearchURL'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Default_Page_URL'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Default_Search_URL'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Search Page'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Start Page'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Main', value: 'Search Bar'}
labels: [Browser]
supported_os: [Windows]
urls:
- 'https://support.microsoft.com/en-us/kb/895339'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: InternetExplorerTypedURLsKeys
doc: Microsoft Internet Explorer TypedUrls keys.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\TypedURLs\*']}
labels: [Browser]
supported_os: [Windows]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Internet_Explorer#Typed_URLs']
---
name: OperaHistory
doc: Opera browser history (global_history.dat).
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Opera/global_history.dat']}
  supported_os: [Darwin]
- type: FILE
  attributes: {paths: ['%%users.homedir%%/.opera/global_history.dat']}
  supported_os: [Linux]
- type: FILE
  attributes:
    paths:
    - '%%users.appdata%%\Opera\Opera\global_history.dat'
    - '%%users.appdata%%\Opera Software\Opera Stable\History'
    separator: '\'
  supported_os: [Windows]
supported_os: [Windows,Darwin,Linux]
labels: [Browser]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Opera']
---
name: SafariCache
doc: Safari browser cache (cache.db).
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Apple Computer\Safari\cache.db']
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Caches/com.apple.Safari/Cache.db'
    - '%%users.homedir%%/Library/Caches/com.apple.Safari/Cache.db-wal'
  supported_os: [Darwin]
supported_os: [Windows, Darwin]
labels: [Browser]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Apple_Safari']
---
name: SafariDownloads
doc: Safari downloads history (Downloads.plist).
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Safari/Downloads.plist']}
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Apple Computer\Safari\Downloads.plist'
    - '%%users.appdata%%\Apple Computer\Safari\Downloads.plist'
    separator: '\'
  supported_os: [Windows]
labels: [Users, Browser]
supported_os: [Darwin, Windows]
urls:
- 'https://forensicswiki.xyz/wiki/index.php?title=Mac_OS_X'
- 'https://forensicswiki.xyz/wiki/index.php?title=Mac_OS_X_10.9_-_Artifacts_Location#Safari'
- 'https://www.forensicswiki.org/wiki/Apple_Safari'
---
name: SafariHistory
doc: Safari browser history (History.plist).
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Apple Computer\Safari\History.plist'
    - '%%users.appdata%%\Apple Computer\Safari\History.plist'
    separator: '\'
  supported_os: [Windows]
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Safari/History.plist'
    - '%%users.homedir%%/Library/Safari/History.db'
    - '%%users.homedir%%/Library/Safari/History.db-wal'
  supported_os: [Darwin]
supported_os: [Windows, Darwin]
labels: [Browser]
urls: ['https://forensicswiki.xyz/wiki/index.php?title=Apple_Safari']
---
name: SafariExtensions
doc: Safari browser Extensions.
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Safari/Extensions/**']}
  supported_os: [Darwin]
supported_os: [Darwin]
labels: [Browser]
urls: ['http://www.forensicswiki.org/wiki/Apple_Safari']