Chrome forensics with python

Google Chrome stores the browser history in a SQLite database in the following locations:

  • Windows 7 and 10: C:\Users\[USERNAME]\AppData\Local\Google\Chrome\
  • Linux: /home/$USER/.config/google-chrome/

The database file that contains the browsing history is stored under the Default folder as "History" and can be examined using any SQlite browser (https://sqlitebrowser.org/).

On a Windows machine, this database usually can be found under the following path: C:\Users\<YOURUSERNAME>\AppData\Local\Google\Chrome\User Data\Default

For example, with windows OS in path C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\History we can find the sqlite database that stores Chrome's web history.

Here are the ...

Get Mastering Python for Networking and Security now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.