fox-it / dissect.target

The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).
GNU Affero General Public License v3.0
38 stars 42 forks source link

Add retrieval browser data "Snapshots" folder #680

Open mick-314 opened 2 months ago

mick-314 commented 2 months ago

Certain browsers create snapshots during major version updates. These snapshots allow for rollbacks and contain user data, and are thus interesting to take into account as well when retrieving browser information. This PR adds functionality to also retrieve user data from the "Snapshots" directory for the browsers Chrome and Edge.

See the following links for more some context:

This PR adds a globbing feature to the ChromiumMixin class, which the ChromePlugin and EdgePlugin classes both inherit from. _build_userdirs() now supports globbing, and EdgePlugin and ChromePlugin have the wildcard paths that take into account the browser snapshots in the "Snapshots" folder.

Resolves #679.