Chrome Favicons
Overview
Section titled “Overview”Evidence: Chrome Favicons
Description: Collect Chrome Favicons
Category: Applications
Platform: macos
Short Name: cfico
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Browser favicons are cached website icons that provide visual history of visited sites. This data supplements browsing history by revealing sites accessed even if history was deleted.
Data Collected
Section titled “Data Collected”This collector gathers structured data about chrome favicons.
Chrome Favicons Data
Section titled “Chrome Favicons Data”| Field | Description | Example |
|---|---|---|
ID | ID | 123 |
UserName | User Name | Example value |
BrowserName | Browser Name | Example value |
Profile | Profile | Example value |
URL | URL | Example value |
IconType | Icon Type | 123 |
Path | Path | Example value |
Collection Method
Section titled “Collection Method”This collector queries the browser’s Favicons database to extract cached website icons and associated URLs.
Forensic Value
Section titled “Forensic Value”Favicon analysis can recover evidence of deleted browsing history, identify visited sites through icon fingerprinting, and correlate with other browser artifacts to establish comprehensive activity timelines.