Skip to content

Commit 8df003c

Browse files
authored
Add Snapshot Paths for macOS and Windows Chromium Browsers (#48)
Includes paths for Chromium Snapshot paths on macOS and Windows. This was introduced in Chrome 84 and creates backup copies from the last three browser updates. This includes browsing history and bookmarks. This can surface browsing history not in the main database making it useful for hunting.
1 parent 34b4780 commit 8df003c

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

bin/config.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,20 @@ Globs:
77
WindowsChromeProfiles:
88
- C:\Users\*\AppData\{Roaming,Local}\*\*\User Data
99
- C:\Windows\{System32,SysWOW64}\config\systemprofile\AppData\{Roaming,Local}\*\*\User Data
10+
- C:\Users\*\AppData\{Roaming,Local}\*\*\User Data\Snapshots\*\
11+
- C:\Windows\{System32,SysWOW64}\config\systemprofile\AppData\{Roaming,Local}\*\*\User Data\Snapshots\*\
1012
- C:\Users\*\AppData\{Roaming,Local}\*\User Data
1113
- C:\Windows\{System32,SysWOW64}\config\systemprofile\AppData\{Roaming,Local}\*\User Data
14+
- C:\Users\*\AppData\{Roaming,Local}\*\User Data\Snapshots\*\
15+
- C:\Windows\{System32,SysWOW64}\config\systemprofile\AppData\{Roaming,Local}\*\User Data\Snapshots\*\
1216
- C:\Users\*\AppData\{Roaming,Local}\Opera Software\Opera*\
1317
- C:\Windows\{System32,SysWOW64}\config\systemprofile\AppData\{Roaming,Local}\Opera Software\Opera*\
1418
- C:\Users\*\AppData\Local\Packages\TheBrowserCompany.Arc_*\LocalCache\Local\Arc\User Data
1519
MacOSChromeProfiles:
1620
- /Users/*/Library/Application Support/*/*/
21+
- /Users/*/Library/Application Support/*/*/Snapshots/*/
1722
- /Users/*/Library/Application Support/*/
23+
- /Users/*/Library/Application Support/*/Snapshots/*/
1824
WindowsFirefoxProfiles:
1925
- C:\Users\*\AppData\{Roaming,Local}\*\*\Profiles
2026
- C:\Windows\{System32,SysWOW64}\config\systemprofile\AppData\{Roaming,Local}\*\*\Profiles

0 commit comments

Comments
 (0)