Opera Omnibox Shortcuts
Overview
Section titled “Overview”Evidence: Opera Omnibox Shortcuts
Description: Collect Opera Omnibox Shortcuts
Category: Applications
Platform: linux
Short Name: oshct
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”Opera keeps a Shortcuts database beside History in each profile. It records what was typed in the address bar and which suggestion was accepted, including partial input that never became a visit.
Data Collected
Section titled “Data Collected”Parsed rows are stored in browser_shortcuts.
Opera Omnibox Shortcuts Data
Section titled “Opera Omnibox Shortcuts Data”| Field | Description | Example |
|---|---|---|
UserName | Account that owns the profile | Example value |
BrowserName | Browser the database belongs to | Opera |
ProfileName | Browser profile directory | Default |
Text | Text typed in the address bar | mega |
FillIntoEdit | Completion the browser filled into the address bar | mega.nz/folder |
URL | Destination the user accepted | https://mega.nz/folder |
Contents | Display string of the suggestion | mega.nz/folder |
Description | Secondary display text, often the page title | MEGA |
LastAccessTime | Last time this shortcut was used, in UTC. Empty when unset | 2023-10-15 14:30:25+03:00 |
NumberOfHits | How often this shortcut was used. Empty when unset | 7 |
FilePath | Shortcuts database the row came from | Example value |
Collection Method
Section titled “Collection Method”The collector copies each profile Shortcuts database and its -wal, -shm, and -journal companions, then parses the omnibox shortcut rows. It looks under:
/home/*/.config/opera/Shortcuts/home/*/.config/opera/Default/Shortcuts
Forensic Value
Section titled “Forensic Value”The typed text shows searches and addresses the user started, including ones that never became a history visit. Last access time and hit count show which suggestions became a habit.