FileZilla Sessions
Overview
Section titled “Overview”Evidence: FileZilla Sessions
Description: Collect FileZilla Sessions & Site Manager Settings
Category: Applications
Platform: windows
Short Name: flz
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”FileZilla FTP client stores server configurations, connection history, and transfer logs in XML and SQLite database files. These files contain FTP/SFTP server credentials, connection details, and file transfer history.
Data Collected
Section titled “Data Collected”This collector gathers structured data about filezilla sessions.
Collection Method
Section titled “Collection Method”This collector gathers FileZilla configuration XML files, site manager XML files, and SQLite databases from the Roaming profile containing server configurations and connection history.
Forensic Value
Section titled “Forensic Value”FileZilla artifacts reveal FTP servers accessed, credentials (often stored in plaintext), file transfer activities, and remote server connections. This is critical for investigating data exfiltration, unauthorized server access, and identifying compromised credentials.