Chromium Form History
Overview
Section titled “Overview”Evidence: Chromium Form History
Description: Collect Chromium Form History
Category: Applications
Platform: linux
Short Name: chfh
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Browser form history stores previously entered form data including search queries, usernames, and other input fields. This data reveals user search patterns, account information, and potential data leakage through autofill.
Data Collected
Section titled “Data Collected”This collector gathers structured data about chromium form history.
Collection Method
Section titled “Collection Method”This collector queries the browser’s form history database to extract saved form field data, search queries, and associated timestamps.
Forensic Value
Section titled “Forensic Value”Form history exposes reconnaissance activities, credential enumeration attempts, search queries revealing attacker intent, and potentially sensitive information entered into web forms. Analysts can identify data exfiltration, account compromise indicators, and targeted search patterns.