From a479d9da05559baaa65c5650057c629484d823ec Mon Sep 17 00:00:00 2001 From: Ryan Date: Wed, 31 Jul 2019 13:22:10 -0700 Subject: [PATCH] Update to support Chrome v76. Add error handling around corrupt LevelDBs. --- .../structure/all_chrome_profiles.json | 3811 +++++++++++++++++ pyhindsight/__init__.py | 2 +- pyhindsight/browsers/chrome.py | 40 +- 3 files changed, 3821 insertions(+), 32 deletions(-) diff --git a/documentation/structure/all_chrome_profiles.json b/documentation/structure/all_chrome_profiles.json index e639bb2..a510807 100644 --- a/documentation/structure/all_chrome_profiles.json +++ b/documentation/structure/all_chrome_profiles.json @@ -116695,6 +116695,3817 @@ } ] }, + "76": { + "type": "version 76", + "name": "Chrome Profile Directory", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "directory", + "name": "AutofillStrikeDatabase", + "children": [ + { + "type": "empty file", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "directory", + "name": "BudgetDatabase", + "children": [ + { + "type": "empty file", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "directory", + "name": "Cache", + "children": [ + { + "type": "Chrome Data Block v2.0", + "name": "data_0" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_1" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_2" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_3" + }, + { + "type": "unknown", + "name": "f_000001" + }, + { + "type": "unknown", + "name": "f_000002" + }, + { + "type": "unknown", + "name": "f_000003" + }, + { + "type": "unknown", + "name": "f_000004" + }, + { + "type": "unknown", + "name": "f_000006" + }, + { + "type": "305 cache files removed", + "name": "..." + }, + { + "type": "unknown", + "name": "f_00013b" + }, + { + "type": "unknown", + "name": "f_00013c" + }, + { + "type": "unknown", + "name": "f_00013d" + }, + { + "type": "unknown", + "name": "f_00013e" + }, + { + "type": "Chrome Index v2.1", + "name": "index" + } + ] + }, + { + "type": "directory", + "name": "Code Cache", + "children": [ + { + "type": "directory", + "name": "js", + "children": [ + { + "type": "Simple Cache Entry v5", + "name": "01c059c9166ab0fd_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "0263d85bfc33907c_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "0302ee40297d71d1_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "033a8585d9fd000f_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "03e25f538a4d1f7e_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "044a23c8148e4e38_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "05102e1be13b8f21_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "05cdabd4651c4d19_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "05f72b59268e6a40_0" + }, + { + "type": "203 items removed", + "name": "..." + }, + { + "type": "Simple Cache Entry v5", + "name": "f594fb6c7059b3f0_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "f7c379d05c500691_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "f8e49d8549e30e66_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "f907b0a324281b0e_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "f97767b3c519aa4a_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "fb8121da1adc5e79_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "fc8dfb269fdb95e8_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "fe4d1516341d8871_0" + }, + { + "type": "Simple Cache Entry v9", + "name": "index" + }, + { + "type": "directory", + "name": "index-dir", + "children": [ + { + "type": "unknown", + "name": "the-real-index" + } + ] + } + ] + } + ] + }, + { + "type": "SQLite3 database", + "name": "Cookies", + "children": [ + { + "type": "SQLite3 Table", + "name": "meta", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "cookies", + "children": [ + { + "type": "SQLite3 Column", + "name": "creation_utc" + }, + { + "type": "SQLite3 Column", + "name": "host_key" + }, + { + "type": "SQLite3 Column", + "name": "name" + }, + { + "type": "SQLite3 Column", + "name": "value" + }, + { + "type": "SQLite3 Column", + "name": "path" + }, + { + "type": "SQLite3 Column", + "name": "expires_utc" + }, + { + "type": "SQLite3 Column", + "name": "is_secure" + }, + { + "type": "SQLite3 Column", + "name": "is_httponly" + }, + { + "type": "SQLite3 Column", + "name": "last_access_utc" + }, + { + "type": "SQLite3 Column", + "name": "has_expires" + }, + { + "type": "SQLite3 Column", + "name": "is_persistent" + }, + { + "type": "SQLite3 Column", + "name": "priority" + }, + { + "type": "SQLite3 Column", + "name": "encrypted_value" + }, + { + "type": "SQLite3 Column", + "name": "samesite" + } + ] + } + ] + }, + { + "type": "SNSS v1", + "name": "Current Session" + }, + { + "type": "SNSS v1", + "name": "Current Tabs" + }, + { + "type": "directory", + "name": "Extension Rules", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "directory", + "name": "Extension State", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "directory", + "name": "Extensions", + "children": [ + { + "type": "directory", + "name": "aapocclcgogkmnckokdopfmhonfmgoek", + "children": [ + { + "type": "directory", + "name": "0.10_0", + "children": [ + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "ar", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "bg", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ca", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "36 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "vi", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_CN", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "computed_hashes.json" + }, + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "Portable Network Graphics file", + "name": "icon_128.png" + }, + { + "type": "Portable Network Graphics file", + "name": "icon_16.png" + }, + { + "type": "unknown", + "name": "main.html" + }, + { + "type": "unknown", + "name": "main.js" + }, + { + "type": "JSON", + "name": "manifest.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "aohghmighlieiainnegkcijnfilokake", + "children": [ + { + "type": "directory", + "name": "0.10_0", + "children": [ + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "ar", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "bg", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ca", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "36 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "vi", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_CN", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "computed_hashes.json" + }, + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "Portable Network Graphics file", + "name": "icon_128.png" + }, + { + "type": "Portable Network Graphics file", + "name": "icon_16.png" + }, + { + "type": "unknown", + "name": "main.html" + }, + { + "type": "unknown", + "name": "main.js" + }, + { + "type": "JSON", + "name": "manifest.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "apdfllckaahabafndbhieahigkjlhalf", + "children": [ + { + "type": "directory", + "name": "14.2_0", + "children": [ + { + "type": "Portable Network Graphics file", + "name": "128.png" + }, + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "ar", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "bg", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ca", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "38 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "vi", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_CN", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "JSON", + "name": "manifest.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "blpcfgokakmgnkcojhhkbfbldkacnbeo", + "children": [ + { + "type": "directory", + "name": "4.2.8_0", + "children": [ + { + "type": "Portable Network Graphics file", + "name": "128.png" + }, + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "ar", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "bg", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ca", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "33 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "vi", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_CN", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "JSON", + "name": "manifest.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "felcaaldnbdncclmgdcncolpebgiejap", + "children": [ + { + "type": "directory", + "name": "1.2_0", + "children": [ + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "ar", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "bg", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ca", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "36 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "vi", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_CN", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "computed_hashes.json" + }, + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "Portable Network Graphics file", + "name": "icon_128.png" + }, + { + "type": "Portable Network Graphics file", + "name": "icon_16.png" + }, + { + "type": "unknown", + "name": "main.html" + }, + { + "type": "unknown", + "name": "main.js" + }, + { + "type": "JSON", + "name": "manifest.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "ghbmnnjooekpmoecnnnilnnbdlolhkhi", + "children": [ + { + "type": "directory", + "name": "1.7_0", + "children": [ + { + "type": "Portable Network Graphics file", + "name": "128.png" + }, + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "af", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "am", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ar", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "67 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "zh_HK", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zu", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "computed_hashes.json" + }, + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "JSON", + "name": "dasherSettingSchema.json" + }, + { + "type": "unknown", + "name": "eventpage_bin_prod.js" + }, + { + "type": "JSON", + "name": "manifest.json" + }, + { + "type": "unknown", + "name": "page_embed_script.js" + }, + { + "type": "directory", + "name": "resources", + "children": [ + { + "type": "unknown", + "name": "Roboto-Medium.ttf" + }, + { + "type": "unknown", + "name": "Roboto-Regular.ttf" + }, + { + "type": "Portable Network Graphics file", + "name": "arrowUp.png" + }, + { + "type": "Portable Network Graphics file", + "name": "docs.png" + }, + { + "type": "Portable Network Graphics file", + "name": "logo.png" + }, + { + "type": "Portable Network Graphics file", + "name": "offlineIcon.png" + }, + { + "type": "Portable Network Graphics file", + "name": "questionMark.png" + }, + { + "type": "Portable Network Graphics file", + "name": "sheets.png" + }, + { + "type": "Portable Network Graphics file", + "name": "slides.png" + } + ] + } + ] + } + ] + }, + { + "type": "directory", + "name": "nmmhkkegccagdldgiimedpiccmgmieda", + "children": [ + { + "type": "directory", + "name": "1.0.0.4_0", + "children": [ + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "bg", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ca", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "cs", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "34 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "vi", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_CN", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "unknown", + "name": "craw_background.js" + }, + { + "type": "unknown", + "name": "craw_window.js" + }, + { + "type": "directory", + "name": "css", + "children": [ + { + "type": "unknown", + "name": "craw_window.css" + } + ] + }, + { + "type": "directory", + "name": "html", + "children": [ + { + "type": "unknown", + "name": "craw_window.html" + } + ] + }, + { + "type": "directory", + "name": "images", + "children": [ + { + "type": "Graphics interchange format file (GIF87a)", + "name": "flapper.gif" + }, + { + "type": "Portable Network Graphics file", + "name": "icon_128.png" + }, + { + "type": "Portable Network Graphics file", + "name": "icon_16.png" + }, + { + "type": "Portable Network Graphics file", + "name": "topbar_floating_button.png" + }, + { + "type": "Portable Network Graphics file", + "name": "topbar_floating_button_close.png" + }, + { + "type": "Portable Network Graphics file", + "name": "topbar_floating_button_hover.png" + }, + { + "type": "Portable Network Graphics file", + "name": "topbar_floating_button_maximize.png" + }, + { + "type": "Portable Network Graphics file", + "name": "topbar_floating_button_pressed.png" + } + ] + }, + { + "type": "JSON", + "name": "manifest.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "pjkljhegncpnkpknbcohdijeoejaedia", + "children": [ + { + "type": "directory", + "name": "8.2_0", + "children": [ + { + "type": "Portable Network Graphics file", + "name": "128.png" + }, + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "ar", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "bg", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ca", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "32 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "vi", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_CN", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "JSON", + "name": "manifest.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "pkedcjkdefgpdelpbcmbmeomcjbeemfm", + "children": [ + { + "type": "directory", + "name": "7619.603.0.2_0", + "children": [ + { + "type": "directory", + "name": "_locales", + "children": [ + { + "type": "directory", + "name": "am", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "ar", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "bg", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "44 language directories removed", + "name": "..." + }, + { + "type": "directory", + "name": "vi", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + }, + { + "type": "directory", + "name": "zh_TW", + "children": [ + { + "type": "JSON", + "name": "messages.json" + } + ] + } + ] + }, + { + "type": "directory", + "name": "_metadata", + "children": [ + { + "type": "JSON", + "name": "computed_hashes.json" + }, + { + "type": "JSON", + "name": "verified_contents.json" + } + ] + }, + { + "type": "unknown", + "name": "angular.js" + }, + { + "type": "unknown", + "name": "background_script.js" + }, + { + "type": "unknown", + "name": "cast_sender.js" + }, + { + "type": "directory", + "name": "cast_setup", + "children": [ + { + "type": "unknown", + "name": "cast_app.js" + }, + { + "type": "unknown", + "name": "cast_app_min.css" + }, + { + "type": "unknown", + "name": "cast_app_redirect.js" + }, + { + "type": "Portable Network Graphics file", + "name": "chromecast_logo_grey.png" + }, + { + "type": "unknown", + "name": "devices.html" + }, + { + "type": "unknown", + "name": "index.html" + }, + { + "type": "unknown", + "name": "offers.html" + }, + { + "type": "unknown", + "name": "setup.html" + } + ] + }, + { + "type": "unknown", + "name": "common.js" + }, + { + "type": "unknown", + "name": "feedback.css" + }, + { + "type": "unknown", + "name": "feedback.html" + }, + { + "type": "unknown", + "name": "feedback_script.js" + }, + { + "type": "JSON", + "name": "manifest.json" + }, + { + "type": "unknown", + "name": "material_css_min.css" + }, + { + "type": "unknown", + "name": "mirroring_cast_streaming.js" + }, + { + "type": "unknown", + "name": "mirroring_common.js" + }, + { + "type": "unknown", + "name": "mirroring_hangouts.js" + }, + { + "type": "unknown", + "name": "mirroring_webrtc.js" + } + ] + } + ] + } + ] + }, + { + "type": "SQLite3 database", + "name": "Favicons", + "children": [ + { + "type": "SQLite3 Table", + "name": "meta", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "icon_mapping", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "page_url" + }, + { + "type": "SQLite3 Column", + "name": "icon_id" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "favicons", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "url" + }, + { + "type": "SQLite3 Column", + "name": "icon_type" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "favicon_bitmaps", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "icon_id" + }, + { + "type": "SQLite3 Column", + "name": "last_updated" + }, + { + "type": "SQLite3 Column", + "name": "image_data" + }, + { + "type": "SQLite3 Column", + "name": "width" + }, + { + "type": "SQLite3 Column", + "name": "height" + }, + { + "type": "SQLite3 Column", + "name": "last_requested" + } + ] + } + ] + }, + { + "type": "directory", + "name": "Feature Engagement Tracker", + "children": [ + { + "type": "directory", + "name": "AvailabilityDB", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "directory", + "name": "EventDB", + "children": [ + { + "type": "empty file", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + } + ] + }, + { + "type": "directory", + "name": "GPUCache", + "children": [ + { + "type": "Chrome Data Block v2.0", + "name": "data_0" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_1" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_2" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_3" + }, + { + "type": "unknown", + "name": "f_000001" + }, + { + "type": "unknown", + "name": "f_000002" + }, + { + "type": "unknown", + "name": "f_000003" + }, + { + "type": "unknown", + "name": "f_000004" + }, + { + "type": "unknown", + "name": "f_000005" + }, + { + "type": "Chrome Index v2.0", + "name": "index" + } + ] + }, + { + "type": "Icon Image file", + "name": "Google Profile.ico" + }, + { + "type": "SQLite3 database", + "name": "History", + "children": [ + { + "type": "SQLite3 Table", + "name": "meta", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "urls", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "url" + }, + { + "type": "SQLite3 Column", + "name": "title" + }, + { + "type": "SQLite3 Column", + "name": "visit_count" + }, + { + "type": "SQLite3 Column", + "name": "typed_count" + }, + { + "type": "SQLite3 Column", + "name": "last_visit_time" + }, + { + "type": "SQLite3 Column", + "name": "hidden" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "sqlite_sequence", + "children": [ + { + "type": "SQLite3 Column", + "name": "name" + }, + { + "type": "SQLite3 Column", + "name": "seq" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "visits", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "url" + }, + { + "type": "SQLite3 Column", + "name": "visit_time" + }, + { + "type": "SQLite3 Column", + "name": "from_visit" + }, + { + "type": "SQLite3 Column", + "name": "transition" + }, + { + "type": "SQLite3 Column", + "name": "segment_id" + }, + { + "type": "SQLite3 Column", + "name": "visit_duration" + }, + { + "type": "SQLite3 Column", + "name": "incremented_omnibox_typed_score" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "visit_source", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "source" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "keyword_search_terms", + "children": [ + { + "type": "SQLite3 Column", + "name": "keyword_id" + }, + { + "type": "SQLite3 Column", + "name": "url_id" + }, + { + "type": "SQLite3 Column", + "name": "lower_term" + }, + { + "type": "SQLite3 Column", + "name": "term" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "downloads", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "guid" + }, + { + "type": "SQLite3 Column", + "name": "current_path" + }, + { + "type": "SQLite3 Column", + "name": "target_path" + }, + { + "type": "SQLite3 Column", + "name": "start_time" + }, + { + "type": "SQLite3 Column", + "name": "received_bytes" + }, + { + "type": "SQLite3 Column", + "name": "total_bytes" + }, + { + "type": "SQLite3 Column", + "name": "state" + }, + { + "type": "SQLite3 Column", + "name": "danger_type" + }, + { + "type": "SQLite3 Column", + "name": "interrupt_reason" + }, + { + "type": "SQLite3 Column", + "name": "hash" + }, + { + "type": "SQLite3 Column", + "name": "end_time" + }, + { + "type": "SQLite3 Column", + "name": "opened" + }, + { + "type": "SQLite3 Column", + "name": "last_access_time" + }, + { + "type": "SQLite3 Column", + "name": "transient" + }, + { + "type": "SQLite3 Column", + "name": "referrer" + }, + { + "type": "SQLite3 Column", + "name": "site_url" + }, + { + "type": "SQLite3 Column", + "name": "tab_url" + }, + { + "type": "SQLite3 Column", + "name": "tab_referrer_url" + }, + { + "type": "SQLite3 Column", + "name": "http_method" + }, + { + "type": "SQLite3 Column", + "name": "by_ext_id" + }, + { + "type": "SQLite3 Column", + "name": "by_ext_name" + }, + { + "type": "SQLite3 Column", + "name": "etag" + }, + { + "type": "SQLite3 Column", + "name": "last_modified" + }, + { + "type": "SQLite3 Column", + "name": "mime_type" + }, + { + "type": "SQLite3 Column", + "name": "original_mime_type" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "downloads_url_chains", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "chain_index" + }, + { + "type": "SQLite3 Column", + "name": "url" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "downloads_slices", + "children": [ + { + "type": "SQLite3 Column", + "name": "download_id" + }, + { + "type": "SQLite3 Column", + "name": "offset" + }, + { + "type": "SQLite3 Column", + "name": "received_bytes" + }, + { + "type": "SQLite3 Column", + "name": "finished" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "segments", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "name" + }, + { + "type": "SQLite3 Column", + "name": "url_id" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "segment_usage", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "segment_id" + }, + { + "type": "SQLite3 Column", + "name": "time_slot" + }, + { + "type": "SQLite3 Column", + "name": "visit_count" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "typed_url_sync_metadata", + "children": [ + { + "type": "SQLite3 Column", + "name": "storage_key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + } + ] + }, + { + "type": "unknown", + "name": "History Provider Cache" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "directory", + "name": "Local Extension Settings", + "children": [ + { + "type": "directory", + "name": "ghbmnnjooekpmoecnnnilnnbdlolhkhi", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + } + ] + }, + { + "type": "directory", + "name": "Local Storage", + "children": [ + { + "type": "directory", + "name": "leveldb", + "children": [ + { + "type": "LevelDB Sorted Table File", + "name": "000005.ldb" + }, + { + "type": "LevelDB Sorted Table File", + "name": "000007.ldb" + }, + { + "type": "LevelDB Sorted Table File", + "name": "000009.ldb" + }, + { + "type": "unknown", + "name": "000011.sst" + }, + { + "type": "empty file", + "name": "000016.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Info Log", + "name": "LOG.old" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000015" + } + ] + } + ] + }, + { + "type": "SQLite3 database", + "name": "Login Data", + "children": [ + { + "type": "SQLite3 Table", + "name": "meta", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "logins", + "children": [ + { + "type": "SQLite3 Column", + "name": "origin_url" + }, + { + "type": "SQLite3 Column", + "name": "action_url" + }, + { + "type": "SQLite3 Column", + "name": "username_element" + }, + { + "type": "SQLite3 Column", + "name": "username_value" + }, + { + "type": "SQLite3 Column", + "name": "password_element" + }, + { + "type": "SQLite3 Column", + "name": "password_value" + }, + { + "type": "SQLite3 Column", + "name": "submit_element" + }, + { + "type": "SQLite3 Column", + "name": "signon_realm" + }, + { + "type": "SQLite3 Column", + "name": "preferred" + }, + { + "type": "SQLite3 Column", + "name": "date_created" + }, + { + "type": "SQLite3 Column", + "name": "blacklisted_by_user" + }, + { + "type": "SQLite3 Column", + "name": "scheme" + }, + { + "type": "SQLite3 Column", + "name": "password_type" + }, + { + "type": "SQLite3 Column", + "name": "times_used" + }, + { + "type": "SQLite3 Column", + "name": "form_data" + }, + { + "type": "SQLite3 Column", + "name": "date_synced" + }, + { + "type": "SQLite3 Column", + "name": "display_name" + }, + { + "type": "SQLite3 Column", + "name": "icon_url" + }, + { + "type": "SQLite3 Column", + "name": "federation_url" + }, + { + "type": "SQLite3 Column", + "name": "skip_zero_click" + }, + { + "type": "SQLite3 Column", + "name": "generation_upload_status" + }, + { + "type": "SQLite3 Column", + "name": "possible_username_pairs" + }, + { + "type": "SQLite3 Column", + "name": "id" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "sync_entities_metadata", + "children": [ + { + "type": "SQLite3 Column", + "name": "storage_key" + }, + { + "type": "SQLite3 Column", + "name": "metadata" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "sync_model_metadata", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "model_metadata" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "stats", + "children": [ + { + "type": "SQLite3 Column", + "name": "origin_domain" + }, + { + "type": "SQLite3 Column", + "name": "username_value" + }, + { + "type": "SQLite3 Column", + "name": "dismissal_count" + }, + { + "type": "SQLite3 Column", + "name": "update_time" + } + ] + } + ] + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000002" + }, + { + "type": "SQLite3 database", + "name": "Network Action Predictor", + "children": [ + { + "type": "SQLite3 Table", + "name": "network_action_predictor", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "user_text" + }, + { + "type": "SQLite3 Column", + "name": "url" + }, + { + "type": "SQLite3 Column", + "name": "number_of_hits" + }, + { + "type": "SQLite3 Column", + "name": "number_of_misses" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "resource_prefetch_predictor_metadata", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "resource_prefetch_predictor_host_redirect", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "proto" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "resource_prefetch_predictor_origin", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "proto" + } + ] + } + ] + }, + { + "type": "JSON", + "name": "Network Persistent State" + }, + { + "type": "directory", + "name": "Platform Notifications", + "children": [ + { + "type": "empty file", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "JSON", + "name": "Preferences" + }, + { + "type": "SQLite3 database", + "name": "QuotaManager", + "children": [ + { + "type": "SQLite3 Table", + "name": "meta", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "HostQuotaTable", + "children": [ + { + "type": "SQLite3 Column", + "name": "host" + }, + { + "type": "SQLite3 Column", + "name": "type" + }, + { + "type": "SQLite3 Column", + "name": "quota" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "OriginInfoTable", + "children": [ + { + "type": "SQLite3 Column", + "name": "origin" + }, + { + "type": "SQLite3 Column", + "name": "type" + }, + { + "type": "SQLite3 Column", + "name": "used_count" + }, + { + "type": "SQLite3 Column", + "name": "last_access_time" + }, + { + "type": "SQLite3 Column", + "name": "last_modified_time" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "EvictionInfoTable", + "children": [ + { + "type": "SQLite3 Column", + "name": "origin" + }, + { + "type": "SQLite3 Column", + "name": "type" + }, + { + "type": "SQLite3 Column", + "name": "last_eviction_time" + } + ] + } + ] + }, + { + "type": "JSON", + "name": "Secure Preferences" + }, + { + "type": "directory", + "name": "Service Worker", + "children": [ + { + "type": "directory", + "name": "Database", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "directory", + "name": "ScriptCache", + "children": [ + { + "type": "Simple Cache Entry v5", + "name": "2cc80dabc69f58b6_0" + }, + { + "type": "Simple Cache Entry v5", + "name": "2cc80dabc69f58b6_1" + }, + { + "type": "Simple Cache Entry v9", + "name": "index" + }, + { + "type": "directory", + "name": "index-dir", + "children": [ + { + "type": "unknown", + "name": "the-real-index" + } + ] + } + ] + } + ] + }, + { + "type": "directory", + "name": "Session Storage", + "children": [ + { + "type": "LevelDB Log File", + "name": "000004.log" + }, + { + "type": "LevelDB Sorted Table File", + "name": "000005.ldb" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "SQLite3 database", + "name": "Shortcuts", + "children": [ + { + "type": "SQLite3 Table", + "name": "omni_box_shortcuts", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "text" + }, + { + "type": "SQLite3 Column", + "name": "fill_into_edit" + }, + { + "type": "SQLite3 Column", + "name": "url" + }, + { + "type": "SQLite3 Column", + "name": "contents" + }, + { + "type": "SQLite3 Column", + "name": "contents_class" + }, + { + "type": "SQLite3 Column", + "name": "description" + }, + { + "type": "SQLite3 Column", + "name": "description_class" + }, + { + "type": "SQLite3 Column", + "name": "transition" + }, + { + "type": "SQLite3 Column", + "name": "type" + }, + { + "type": "SQLite3 Column", + "name": "keyword" + }, + { + "type": "SQLite3 Column", + "name": "last_access_time" + }, + { + "type": "SQLite3 Column", + "name": "number_of_hits" + } + ] + } + ] + }, + { + "type": "directory", + "name": "Site Characteristics Database", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + }, + { + "type": "directory", + "name": "Storage", + "children": [ + { + "type": "directory", + "name": "ext", + "children": [ + { + "type": "directory", + "name": "gfdkimpbcpahaombhbimeihdjnejgicl", + "children": [ + { + "type": "directory", + "name": "def", + "children": [ + { + "type": "directory", + "name": "Code Cache", + "children": [ + { + "type": "directory", + "name": "js", + "children": [ + { + "type": "Simple Cache Entry v9", + "name": "index" + }, + { + "type": "directory", + "name": "index-dir", + "children": [ + { + "type": "unknown", + "name": "the-real-index" + } + ] + } + ] + } + ] + }, + { + "type": "directory", + "name": "GPUCache", + "children": [ + { + "type": "Chrome Data Block v2.0", + "name": "data_0" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_1" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_2" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_3" + }, + { + "type": "Chrome Index v2.0", + "name": "index" + } + ] + }, + { + "type": "JSON", + "name": "Network Persistent State" + }, + { + "type": "directory", + "name": "Platform Notifications", + "children": [ + { + "type": "empty file", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + } + ] + } + ] + }, + { + "type": "directory", + "name": "nmmhkkegccagdldgiimedpiccmgmieda", + "children": [ + { + "type": "directory", + "name": "def", + "children": [ + { + "type": "directory", + "name": "Code Cache", + "children": [ + { + "type": "directory", + "name": "js", + "children": [ + { + "type": "Simple Cache Entry v9", + "name": "index" + }, + { + "type": "directory", + "name": "index-dir", + "children": [ + { + "type": "unknown", + "name": "the-real-index" + } + ] + } + ] + } + ] + }, + { + "type": "directory", + "name": "GPUCache", + "children": [ + { + "type": "Chrome Data Block v2.0", + "name": "data_0" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_1" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_2" + }, + { + "type": "Chrome Data Block v2.0", + "name": "data_3" + }, + { + "type": "Chrome Index v2.0", + "name": "index" + } + ] + }, + { + "type": "JSON", + "name": "Network Persistent State" + }, + { + "type": "directory", + "name": "Platform Notifications", + "children": [ + { + "type": "empty file", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + } + ] + } + ] + } + ] + } + ] + }, + { + "type": "directory", + "name": "Sync Data", + "children": [ + { + "type": "directory", + "name": "LevelDB", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + } + ] + }, + { + "type": "directory", + "name": "Sync Extension Settings", + "children": [ + { + "type": "directory", + "name": "pkedcjkdefgpdelpbcmbmeomcjbeemfm", + "children": [ + { + "type": "empty file", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + } + ] + }, + { + "type": "SQLite3 database", + "name": "Top Sites", + "children": [ + { + "type": "SQLite3 Table", + "name": "meta", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "top_sites", + "children": [ + { + "type": "SQLite3 Column", + "name": "url" + }, + { + "type": "SQLite3 Column", + "name": "url_rank" + }, + { + "type": "SQLite3 Column", + "name": "title" + }, + { + "type": "SQLite3 Column", + "name": "redirects" + } + ] + } + ] + }, + { + "type": "unknown", + "name": "Translate Ranker Model" + }, + { + "type": "JSON", + "name": "TransportSecurity" + }, + { + "type": "Chrome Visited Links", + "name": "Visited Links" + }, + { + "type": "SQLite3 database", + "name": "Web Data", + "children": [ + { + "type": "SQLite3 Table", + "name": "meta", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "autofill", + "children": [ + { + "type": "SQLite3 Column", + "name": "name" + }, + { + "type": "SQLite3 Column", + "name": "value" + }, + { + "type": "SQLite3 Column", + "name": "value_lower" + }, + { + "type": "SQLite3 Column", + "name": "date_created" + }, + { + "type": "SQLite3 Column", + "name": "date_last_used" + }, + { + "type": "SQLite3 Column", + "name": "count" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "credit_cards", + "children": [ + { + "type": "SQLite3 Column", + "name": "guid" + }, + { + "type": "SQLite3 Column", + "name": "name_on_card" + }, + { + "type": "SQLite3 Column", + "name": "expiration_month" + }, + { + "type": "SQLite3 Column", + "name": "expiration_year" + }, + { + "type": "SQLite3 Column", + "name": "card_number_encrypted" + }, + { + "type": "SQLite3 Column", + "name": "date_modified" + }, + { + "type": "SQLite3 Column", + "name": "origin" + }, + { + "type": "SQLite3 Column", + "name": "use_count" + }, + { + "type": "SQLite3 Column", + "name": "use_date" + }, + { + "type": "SQLite3 Column", + "name": "billing_address_id" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "autofill_profiles", + "children": [ + { + "type": "SQLite3 Column", + "name": "guid" + }, + { + "type": "SQLite3 Column", + "name": "company_name" + }, + { + "type": "SQLite3 Column", + "name": "street_address" + }, + { + "type": "SQLite3 Column", + "name": "dependent_locality" + }, + { + "type": "SQLite3 Column", + "name": "city" + }, + { + "type": "SQLite3 Column", + "name": "state" + }, + { + "type": "SQLite3 Column", + "name": "zipcode" + }, + { + "type": "SQLite3 Column", + "name": "sorting_code" + }, + { + "type": "SQLite3 Column", + "name": "country_code" + }, + { + "type": "SQLite3 Column", + "name": "date_modified" + }, + { + "type": "SQLite3 Column", + "name": "origin" + }, + { + "type": "SQLite3 Column", + "name": "language_code" + }, + { + "type": "SQLite3 Column", + "name": "use_count" + }, + { + "type": "SQLite3 Column", + "name": "use_date" + }, + { + "type": "SQLite3 Column", + "name": "validity_bitfield" + }, + { + "type": "SQLite3 Column", + "name": "is_client_validity_states_updated" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "autofill_profile_names", + "children": [ + { + "type": "SQLite3 Column", + "name": "guid" + }, + { + "type": "SQLite3 Column", + "name": "first_name" + }, + { + "type": "SQLite3 Column", + "name": "middle_name" + }, + { + "type": "SQLite3 Column", + "name": "last_name" + }, + { + "type": "SQLite3 Column", + "name": "full_name" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "autofill_profile_emails", + "children": [ + { + "type": "SQLite3 Column", + "name": "guid" + }, + { + "type": "SQLite3 Column", + "name": "email" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "autofill_profile_phones", + "children": [ + { + "type": "SQLite3 Column", + "name": "guid" + }, + { + "type": "SQLite3 Column", + "name": "number" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "autofill_profiles_trash", + "children": [ + { + "type": "SQLite3 Column", + "name": "guid" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "masked_credit_cards", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "status" + }, + { + "type": "SQLite3 Column", + "name": "name_on_card" + }, + { + "type": "SQLite3 Column", + "name": "network" + }, + { + "type": "SQLite3 Column", + "name": "last_four" + }, + { + "type": "SQLite3 Column", + "name": "exp_month" + }, + { + "type": "SQLite3 Column", + "name": "exp_year" + }, + { + "type": "SQLite3 Column", + "name": "bank_name" + }, + { + "type": "SQLite3 Column", + "name": "type" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "unmasked_credit_cards", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "card_number_encrypted" + }, + { + "type": "SQLite3 Column", + "name": "use_count" + }, + { + "type": "SQLite3 Column", + "name": "use_date" + }, + { + "type": "SQLite3 Column", + "name": "unmask_date" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "server_card_metadata", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "use_count" + }, + { + "type": "SQLite3 Column", + "name": "use_date" + }, + { + "type": "SQLite3 Column", + "name": "billing_address_id" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "server_addresses", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "company_name" + }, + { + "type": "SQLite3 Column", + "name": "street_address" + }, + { + "type": "SQLite3 Column", + "name": "address_1" + }, + { + "type": "SQLite3 Column", + "name": "address_2" + }, + { + "type": "SQLite3 Column", + "name": "address_3" + }, + { + "type": "SQLite3 Column", + "name": "address_4" + }, + { + "type": "SQLite3 Column", + "name": "postal_code" + }, + { + "type": "SQLite3 Column", + "name": "sorting_code" + }, + { + "type": "SQLite3 Column", + "name": "country_code" + }, + { + "type": "SQLite3 Column", + "name": "language_code" + }, + { + "type": "SQLite3 Column", + "name": "recipient_name" + }, + { + "type": "SQLite3 Column", + "name": "phone_number" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "server_address_metadata", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "use_count" + }, + { + "type": "SQLite3 Column", + "name": "use_date" + }, + { + "type": "SQLite3 Column", + "name": "has_converted" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "autofill_sync_metadata", + "children": [ + { + "type": "SQLite3 Column", + "name": "model_type" + }, + { + "type": "SQLite3 Column", + "name": "storage_key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "autofill_model_type_state", + "children": [ + { + "type": "SQLite3 Column", + "name": "model_type" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "payments_customer_data", + "children": [ + { + "type": "SQLite3 Column", + "name": "customer_id" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "keywords", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "short_name" + }, + { + "type": "SQLite3 Column", + "name": "keyword" + }, + { + "type": "SQLite3 Column", + "name": "favicon_url" + }, + { + "type": "SQLite3 Column", + "name": "url" + }, + { + "type": "SQLite3 Column", + "name": "safe_for_autoreplace" + }, + { + "type": "SQLite3 Column", + "name": "originating_url" + }, + { + "type": "SQLite3 Column", + "name": "date_created" + }, + { + "type": "SQLite3 Column", + "name": "usage_count" + }, + { + "type": "SQLite3 Column", + "name": "input_encodings" + }, + { + "type": "SQLite3 Column", + "name": "suggest_url" + }, + { + "type": "SQLite3 Column", + "name": "prepopulate_id" + }, + { + "type": "SQLite3 Column", + "name": "created_by_policy" + }, + { + "type": "SQLite3 Column", + "name": "last_modified" + }, + { + "type": "SQLite3 Column", + "name": "sync_guid" + }, + { + "type": "SQLite3 Column", + "name": "alternate_urls" + }, + { + "type": "SQLite3 Column", + "name": "image_url" + }, + { + "type": "SQLite3 Column", + "name": "search_url_post_params" + }, + { + "type": "SQLite3 Column", + "name": "suggest_url_post_params" + }, + { + "type": "SQLite3 Column", + "name": "image_url_post_params" + }, + { + "type": "SQLite3 Column", + "name": "new_tab_url" + }, + { + "type": "SQLite3 Column", + "name": "last_visited" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "payment_method_manifest", + "children": [ + { + "type": "SQLite3 Column", + "name": "expire_date" + }, + { + "type": "SQLite3 Column", + "name": "method_name" + }, + { + "type": "SQLite3 Column", + "name": "web_app_id" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "web_app_manifest_section", + "children": [ + { + "type": "SQLite3 Column", + "name": "expire_date" + }, + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "min_version" + }, + { + "type": "SQLite3 Column", + "name": "fingerprints" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "token_service", + "children": [ + { + "type": "SQLite3 Column", + "name": "service" + }, + { + "type": "SQLite3 Column", + "name": "encrypted_token" + } + ] + } + ] + }, + { + "type": "directory", + "name": "blob_storage", + "children": [ + { + "type": "directory", + "name": "56c8dd5a-0394-49eb-928d-47a236289212", + "children": [] + } + ] + }, + { + "type": "directory", + "name": "data_reduction_proxy_leveldb", + "children": [ + { + "type": "empty file", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000002" + } + ] + }, + { + "type": "directory", + "name": "databases", + "children": [ + { + "type": "SQLite database file", + "name": "Databases.db", + "children": [ + { + "type": "SQLite3 Table", + "name": "meta", + "children": [ + { + "type": "SQLite3 Column", + "name": "key" + }, + { + "type": "SQLite3 Column", + "name": "value" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "Databases", + "children": [ + { + "type": "SQLite3 Column", + "name": "id" + }, + { + "type": "SQLite3 Column", + "name": "origin" + }, + { + "type": "SQLite3 Column", + "name": "name" + }, + { + "type": "SQLite3 Column", + "name": "description" + }, + { + "type": "SQLite3 Column", + "name": "estimated_size" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "sqlite_sequence", + "children": [ + { + "type": "SQLite3 Column", + "name": "name" + }, + { + "type": "SQLite3 Column", + "name": "seq" + } + ] + } + ] + } + ] + }, + { + "type": "SQLite database file", + "name": "previews_opt_out.db", + "children": [ + { + "type": "SQLite3 Table", + "name": "previews_v1", + "children": [ + { + "type": "SQLite3 Column", + "name": "host_name" + }, + { + "type": "SQLite3 Column", + "name": "time" + }, + { + "type": "SQLite3 Column", + "name": "opt_out" + }, + { + "type": "SQLite3 Column", + "name": "type" + } + ] + }, + { + "type": "SQLite3 Table", + "name": "enabled_previews_v1", + "children": [ + { + "type": "SQLite3 Column", + "name": "type" + }, + { + "type": "SQLite3 Column", + "name": "version" + } + ] + } + ] + }, + { + "type": "directory", + "name": "shared_proto_db", + "children": [ + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "empty file", + "name": "LOG" + }, + { + "type": "directory", + "name": "metadata", + "children": [ + { + "type": "LevelDB Log File", + "name": "000003.log" + }, + { + "type": "LevelDB Current Manifest", + "name": "CURRENT" + }, + { + "type": "empty file", + "name": "LOCK" + }, + { + "type": "LevelDB Info Log", + "name": "LOG" + }, + { + "type": "LevelDB Manifest", + "name": "MANIFEST-000001" + } + ] + } + ] + } + ] + }, "75": { "type": "version 75", "name": "Chrome Profile Directory", diff --git a/pyhindsight/__init__.py b/pyhindsight/__init__.py index 749afcc..20cd7f0 100644 --- a/pyhindsight/__init__.py +++ b/pyhindsight/__init__.py @@ -1,3 +1,3 @@ __author__ = "Ryan Benson" -__version__ = "2.3.1" +__version__ = "2.4.0" __email__ = "ryan@obsidianforensics.com" diff --git a/pyhindsight/browsers/chrome.py b/pyhindsight/browsers/chrome.py index d0e4a03..09037c5 100644 --- a/pyhindsight/browsers/chrome.py +++ b/pyhindsight/browsers/chrome.py @@ -94,7 +94,7 @@ def determine_version(self): Based on research I did to create "Chrome Evolution" tool - dfir.blog/chrome-evolution """ - possible_versions = range(1, 76) + possible_versions = range(1, 77) previous_possible_versions = possible_versions[:] def update_and_rollback_if_empty(version_list, prev_version_list): @@ -157,10 +157,10 @@ def trim_lesser_versions(version): log.debug("Analyzing 'Cookies' structure") log.debug(" - Starting possible versions: {}".format(possible_versions)) if 'cookies' in self.structure['Cookies'].keys(): + trim_lesser_versions_if('samesite', self.structure['Cookies']['cookies'], 76) trim_lesser_versions_if('is_persistent', self.structure['Cookies']['cookies'], 66) trim_lesser_versions_if('priority', self.structure['Cookies']['cookies'], 28) trim_lesser_versions_if('encrypted_value', self.structure['Cookies']['cookies'], 33) - trim_lesser_versions_if('firstpartyonly', self.structure['Cookies']['cookies'], 44) log.debug(" - Finishing possible versions: {}".format(possible_versions)) possible_versions, previous_possible_versions = update_and_rollback_if_empty(possible_versions, previous_possible_versions) @@ -1527,7 +1527,12 @@ def get_prefixed_leveldb_pairs(self, lvl_db_path, prefix=""): log.warning("Failed to import leveldb; unable to process {}".format(lvl_db_path)) return [] - db = leveldb.LevelDB(lvl_db_path, create_if_missing=False) + try: + db = leveldb.LevelDB(lvl_db_path, create_if_missing=False) + except Exception as e: + log.warning(" - Couldn't open {0:s} as LevelDB; {1:s}".format(lvl_db_path, e)) + return [] + cleaned_pairs = [] pairs = list(db.RangeIter()) for pair in pairs: @@ -1546,10 +1551,7 @@ def get_prefixed_leveldb_pairs(self, lvl_db_path, prefix=""): @staticmethod def parse_ls_ldb_dict(ls_dict): origin, ls_key, ls_value = (None, None, None) - - log.debug("Raw: {}".format(str(ls_dict)[:240])) origin_and_key = ls_dict['key'] - log.debug(" Origin_and_key: {}".format(origin_and_key)) if ls_dict['key'].startswith('META:'): origin = ls_dict['key'].split(':', 1)[1] @@ -1562,55 +1564,33 @@ def parse_ls_ldb_dict(ls_dict): else: try: origin, ls_key = ls_dict['key'].split('\x00', 1) - log.debug(" Origin: {}".format(origin)) - log.debug(" RawKey: {}".format(ls_key)) if ls_key.startswith('\x01'): ls_key = ls_key.lstrip('\x01') - log.info(" 1__Key: {}".format(ls_key)) elif ls_key.startswith('\x00'): ls_key = ls_key.lstrip('\x00').decode('utf-16') - log.info(" 0__Key: {}".format(ls_key)) + except Exception as e: log.error("Origin/key parsing error: {}".format(e)) try: ls_value = ls_dict['value'] - log.debug(" Value: {}".format(ls_value[:160])) if ls_value.startswith('\x01'): ls_value = ls_value.lstrip('\x01') - log.info(" 1__Val: {}".format(ls_value[:160])) elif ls_value.startswith('\x00'): ls_value = ls_value.lstrip('\x00').decode('utf-16', errors='replace') - log.info(" 0__Val: {}".format(ls_value)) elif ls_value.startswith('\x08'): ls_value = ls_value.lstrip('\x08') - log.info(" 8__Val: {}".format(ls_value)) except Exception as e: log.error("Value parsing error: {}".format(e)) log.info({'origin': origin, 'key': ls_key, 'value': ls_value}) return {'origin': origin, 'key': ls_key, 'value': ls_value} - # if ls_dict['key'] is 'VERSION': - # return "VERSION" - # try: - # origin, ls_key = ls_dict['key'].split('\x00\x01') - # print(origin, ls_key) - # - # except ValueError: - # try: - # origin, ls_key = ls_dict['key'].split(':', 1) - # except: - # print("ERREREREERIR: {}".format(ls_dict)) - # return False - # - # print(origin, ls_key) - def build_logical_fs_path(self, node, parent_path=None): if not parent_path: parent_path = [] @@ -1621,14 +1601,12 @@ def build_logical_fs_path(self, node, parent_path=None): self.build_logical_fs_path(child_node, parent_path=list(node["path"])) def flatten_nodes_to_list(self, profile_folder, output_list, node): - # def flatten_nodes_to_list(self, output_list, node): output_row = { "type": node["type"], "display_type": node["display_type"], "origin": node["path"][0], "logical_path": "\\".join(node["path"][1:]), "local_path": "{}\\File System\\{}\\{}".format(profile_folder, node["origin_id"], node["type"]) - # "local_path": os.path.join(path, node["origin_id"], node["type"]) } if node.get("fs_path"): output_row["local_path"] += "\\{}\\{}".format(node["fs_path"]["dir"], node["fs_path"]["id"])