Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 6008
  • Last Modified:

Retrieve web browsing history from Chrome

Hi Experts!

I need to retrieve the web-browsing history of one employee . I was happy using NetAnalysis v 1.52 for reading the index.dat from internet explorer .  But this particular employes uses Google Chrome .I checked the c:\doc&Settings\username|localsettings\AppData\Google\Chrome\Userdata but I cannot find the index.dat here.

I cannot access directly that computer, I just can transfer files from the computer and access that PC through command line.
I have tried with several files from Chrome using NetAnalysis but I got the error message " Status: NO Browser data files identified"

Does anybody know a good tool to analyze chrome web browsing history?  and exactly what is the files that can show me all the web browsing history?
Thanks a lot.
0
anbant
Asked:
anbant
  • 4
  • 2
  • 2
  • +1
2 Solutions
 
anbantAuthor Commented:
OK I found the  "History Index 2011-01"  in
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data

But I cannot read this file, for what I have read it seems that this file is encrypted, any ideas what tool can I use to read it?

0
 
_-MYFOX-_Commented:
0
 
Dave BaldwinFixer of ProblemsCommented:
The first characters in the history file say SQLite.  You can find it here: http://www.sqlite.org/
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
anbantAuthor Commented:
Thank you for your comments!

I am having some trouble trying to read the History Index with Chrome Analysis, Fox have you tried Chrome analysis  before?   it works like a charm  when I point to the c:\documents &Settings\Username\local settings\AppData\Google\Chrome\Userdata\Default in my local computer

But when I try to export the "History Index"  that I retrieve from the employee's machine it doesn't show anything, should I export the whole default folder?
Is there a way where I can read just the "history index"  I was trying to pull all the deafult folder but the connection cuts, that folder is too big.
Chrome Forensics cannot read the "History Index" neither.

@Dave,
Thanks for the comment, I am trying to figure out how to make sqlite3 work now. Let see how it goes.
I must present results tomorrow morning, some more ideas???
0
 
anbantAuthor Commented:
@Fox,
These 2 programs are great , they even show me the search in chrome, If I just could run it silently in the target machine,  I just have command line access in that machine, the employee takes the laptop home.
It would be amazing if these programs could read the "history index"...
0
 
Dave BaldwinFixer of ProblemsCommented:
Make a new profile on your machine and copy his history to that one...
0
 
hidden14Commented:
Hi,
Have you tried ChromeCacheView? I have tried it once.. it works nicely as well..

http://www.nirsoft.net/utils/chrome_cache_view.html

0
 
_-MYFOX-_Commented:
As mentioned, you can create your local copy of the index file through the command console, then do all the checks you need
0
 
anbantAuthor Commented:
Thank you very much Guys, Chrome Analysis is better than Chrome Forensics and copying the "history index" to the new profile was the fastest solution.
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

  • 4
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now