Expand Chrome Preferences parser

vonnopsled commented 9 years ago

[ ] add extension.autoupdate.next_check timestamp support
[ ] add extension.install_signature.timestamp timestamp support
[ ] add extension.settings.[ID].lastpingday timestamp support
[ ] Additional ideas from http://www.obsidianforensics.com/blog/the-chrome-history-was-cleared-now-what/

joachimmetz commented 8 years ago

joachimmetz commented 8 years ago

A FR to add more details into the Chrome preferences parser, specifically to parse the:

last_clear_browsing_data_time (WebKit timestamp) indicating the last time the browser history was cleared
There are multiple other timestamps that are found within the Preferences file (that are webkit timestamped), such as,lastpingday, last_check, next_check, etc. that need to be investigated whether or not it makes sense to add them (ATM the only timestamp that is pulled in is the install_time for each extension)

rgayon commented 7 years ago

last_clear_browsing_data_time should be handled by https://codereview.appspot.com/310620043/

Different timestamps encountered in my Preferences file:

account_tracker_service_last_update
- The AccountTrackerService apparently maintains account info in Chrome
data_reduction.last_update_date
extensions.autoupdate.last_check
extensions.autoupdate.next_check
extensions..lastpingday
extensions..last_active_pingday
extensions..last_launch_time
gaia_cookie.changed_time
gcm.check_time
- Probably related to https://developer.chrome.com/apps/gcm
profile.content_settings.exceptions.notifications."https://....".last_used
profile.content_settings.exceptions.site_engagement."https://....".last_used
- cf chrome://site-engagement & https://bugs.chromium.org/p/chromium/issues/detail?id=464234
sync.last_synced_time
sync.first_synced_time

log2timeline / plaso