Solved

Retrieve web browsing history from Chrome

Posted on 2011-02-14
9
5,296 Views
Last Modified: 2012-05-11
Hi Experts!

I need to retrieve the web-browsing history of one employee . I was happy using NetAnalysis v 1.52 for reading the index.dat from internet explorer .  But this particular employes uses Google Chrome .I checked the c:\doc&Settings\username|localsettings\AppData\Google\Chrome\Userdata but I cannot find the index.dat here.

I cannot access directly that computer, I just can transfer files from the computer and access that PC through command line.
I have tried with several files from Chrome using NetAnalysis but I got the error message " Status: NO Browser data files identified"

Does anybody know a good tool to analyze chrome web browsing history?  and exactly what is the files that can show me all the web browsing history?
Thanks a lot.
0
Comment
Question by:anbant
  • 4
  • 2
  • 2
  • +1
9 Comments
 
LVL 1

Author Comment

by:anbant
ID: 34892264
OK I found the  "History Index 2011-01"  in
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data

But I cannot read this file, for what I have read it seems that this file is encrypted, any ideas what tool can I use to read it?

0
 
LVL 5

Accepted Solution

by:
_-MYFOX-_ earned 300 total points
ID: 34892445
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 34892446
The first characters in the history file say SQLite.  You can find it here: http://www.sqlite.org/
0
 
LVL 1

Author Comment

by:anbant
ID: 34893087
Thank you for your comments!

I am having some trouble trying to read the History Index with Chrome Analysis, Fox have you tried Chrome analysis  before?   it works like a charm  when I point to the c:\documents &Settings\Username\local settings\AppData\Google\Chrome\Userdata\Default in my local computer

But when I try to export the "History Index"  that I retrieve from the employee's machine it doesn't show anything, should I export the whole default folder?
Is there a way where I can read just the "history index"  I was trying to pull all the deafult folder but the connection cuts, that folder is too big.
Chrome Forensics cannot read the "History Index" neither.

@Dave,
Thanks for the comment, I am trying to figure out how to make sqlite3 work now. Let see how it goes.
I must present results tomorrow morning, some more ideas???
0
Save on storage to protect fatherhood memories

You're the dad who has everything. This Father's Day, make sure your family memories are protected. My Passport Ultra has automatic backup and password protection to keep your cherished photos and videos safe. With up to 3TB, you have plenty of room to hold the adventures ahead.

 
LVL 1

Author Comment

by:anbant
ID: 34893147
@Fox,
These 2 programs are great , they even show me the search in chrome, If I just could run it silently in the target machine,  I just have command line access in that machine, the employee takes the laptop home.
It would be amazing if these programs could read the "history index"...
0
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 200 total points
ID: 34893284
Make a new profile on your machine and copy his history to that one...
0
 
LVL 1

Expert Comment

by:hidden14
ID: 34894047
Hi,
Have you tried ChromeCacheView? I have tried it once.. it works nicely as well..

http://www.nirsoft.net/utils/chrome_cache_view.html

0
 
LVL 5

Expert Comment

by:_-MYFOX-_
ID: 34896660
As mentioned, you can create your local copy of the index file through the command console, then do all the checks you need
0
 
LVL 1

Author Closing Comment

by:anbant
ID: 34903108
Thank you very much Guys, Chrome Analysis is better than Chrome Forensics and copying the "history index" to the new profile was the fastest solution.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
print logs windows 7 3 75
Retrieve response header - authorization bearer token 34 92
Which browser works with XP 16 115
Browser annoying behavior 18 50
I spend far too much time on the web keeping up with the news: politics, the environment, computer stuff, the Experts Exchange. It's never-ending. But many of the most informative web pages are overwhelmed with noise: scrolling banners, flashing tex…
Now-a-days, indirectly, postal services have been replaced by email services. Yes, whenever we hear the word "email" a lot of people only think of gmail. Some people still think that email and gmail are one and the same thing :-). Let's see some …
This Micro Tutorial will demonstrate how to add subdomains to your content reports. This can be very importing in having a site with multiple subdomains.
How to create a custom search shortcut to site-search Experts Exchange using Google in the Firefox browser. This eliminates the need to type out site:experts-exchange.com whenever you want to search the site. Launch your Bookmark Menu: Press 'Ctrl +…

896 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now