Arc User Profiles

Overview

Evidence: Arc User Profiles
Description: Collect Arc User Profiles
Category: Applications
Platform: macos
Short Name: aprfls
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

Background

Browser user profiles store per-user browser configurations, extensions, settings, and data segregation. This data reveals multiple user accounts, profile switching patterns, and user-specific browsing behavior.

Data Collected

This collector gathers structured data about arc user profiles.

Arc User Profiles Data

Field	Description	Example
`EndpointUserName`	Endpoint User Name	Example value
`Profile`	Profile	Example value
`ProfileUserName`	Profile User Name	Example value
`BrowserName`	Browser Name	Example value
`BackgroundApps`	Background Apps	true
`GoogleAccountGivenName`	Google Account Given Name	Example value
`GoogleAccountID`	Google Account ID	Example value
`GoogleAccountName`	Google Account Name	Example value
`PictureFileName`	Picture File Name	Example value
`LastDownloadedPictureURL`	Last Downloaded Picture URL	Example value
`HostedDomain`	Hosted Domain	Example value
`IsConsentedPrimaryAccount`	Is Consented Primary Account	true
`IsEphemeral`	Is Ephemeral	true

Collection Method

This collector enumerates browser user profiles and extracts profile metadata, configurations, and associated data paths.

Forensic Value

Profile analysis identifies multiple user accounts, profile-specific extensions and configurations, shared device usage patterns, and potential privilege escalation or lateral movement using different browser profiles. Investigators can correlate activity across profiles and identify unauthorized profile creation.