Can anyone please point me in the right direction for the best resource for Chrome forensics, specifically how to link history entries to their corresponding cached components?
I don't have access to IEF, so I'm looking to do this either manually or with free tools.
You may want to consider
It's not free but it's reasonably priced and is capable of extracting a variety of Chrome artefacts including cached files.
£75 - it's expensive.
£75 - it's expensive.
I guess, like beauty, it depends on the beholder. roll
For a pro allegedly payed US $ 250.00/hour it doesn't seem too expensive.
For a casual user or a non-pro it is.
jaclaz
Hi Zearu,
I have also noticed that the precise mechanics of the Google Chrome cache are not very well documented on any forensic resources. I have documented it and may well write it up on my blog.
Any way in the mean time a free tool to do what you need can be found at http//
Regards,
Richard
Anyone who wants can PM me their email address and I'll send them my Chrome forensics cheat-sheet. It might be helpful depending what you're doing.
Whist I haven't looked at the cache yet…
Don't forget, any one user can have several profiles with Chrome, the default is in the 'Default' folder and subsequent one's are in the 'Profile 1' to 'Profile {n}' folders. Under Win 7/8 these can be found in C\Users\{user}\AppData\Local\Google\Chrome\User Data\{profile}\
The history can be found in the two files .\History and .\Archived History the schemas to which (as per my best guess) are
and