Chrome History issue

There is a table in the 'History' SQLite database that Chrome stores data in called visit_source.
This table tracks where the page views ("visits") in the History file came from.

The following is from https://code.google.com/p/chromium/codesearch#chromium/src/components/history/core/browser/history_types.h

// The enumeration of all possible sources of visits is listed below.
// The source will be propagated along with a URL or a visit item
// and eventually be stored in the history database,
// visit_source table specifically.
// Different from page transition types, they describe the origins of visits.
// (Warning) Please don't change any existing values while it is ok to add
// new values when needed.
enum VisitSource {
SOURCE_SYNCED = 0, // Synchronized from somewhere else.
SOURCE_BROWSED = 1, // User browsed.
SOURCE_EXTENSION = 2, // Added by an extension.
SOURCE_FIREFOX_IMPORTED = 3,
SOURCE_IE_IMPORTED = 4,
SOURCE_SAFARI_IMPORTED = 5,
};

One caveat to this is that Chrome doesn't store values of '1' in this table to be more efficient, as most visits are of this type. That means that on a system that doesn't have any synced or imported visits, the visit_source table will be empty.

Hindsight is an open source Chrome forensics tool ( https://github.com/obsidianforensics/hindsight ) that I've created that will parse Chrome history files, and it also parses out the visit_source information (column G "Source" in the XLSX report). If you run Hindsight against all the different Chrome installations, one visit_source table should be missing entries for the visits browsed locally on that device, and have sync values for the visits from other devices.

Apologies for the late reply on this thread - I was searching the board for something else and found it.

The Forensic Browser for SQLite can help you create a nice simple report that decodes this field based on the information above.

All you need to do is add a series of aliases for the different values in the source field from the visit_type table

The following report was created using drag and drop query building with a further column conversion (right click column and select chrome date) for the visit-time column

If anyone would like a fully functional demo if the Forensic Toolkit for SQLite then please visit this link

http//sandersonforensics.com/forum/content.php?212-RequestDemo