Chrome Web Storage
Overview
Section titled “Overview”Evidence: Chrome Web Storage
Description: Collect Chrome Web Storage
Category: Applications
Platform: macos
Short Name: cws
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Browser web storage includes both local and session storage used by websites to store client-side data. This data can contain application state, user preferences, cached content, and potentially sensitive information.
Data Collected
Section titled “Data Collected”This collector gathers structured data about chrome web storage.
Chrome Web Storage Data
Section titled “Chrome Web Storage Data”| Field | Description | Example |
|---|---|---|
UserName | User Name | Example value |
ProfileName | Profile Name | Example value |
BrowserName | Browser Name | Example value |
Key | Key | Example value |
Value | Value | Example value |
Path | Path | Example value |
Collection Method
Section titled “Collection Method”This collector extracts web storage data from browser storage locations including local storage and session storage.
Forensic Value
Section titled “Forensic Value”Web storage analysis reveals cached application data, stored credentials, session information, and potential data exfiltration staging. Analysts can identify malicious website activity, stored authentication tokens, tracking identifiers, and sensitive data cached by compromised web applications.