Chrome Web Storage
Overview
Evidence: Chrome Web Storage
Description: Collect Chrome Web Storage
Category: Applications
Platform: macos
Short Name: cws
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Browser web storage includes both local and session storage used by websites to store client-side data. This data can contain application state, user preferences, cached content, and potentially sensitive information.
Data Collected
This collector gathers structured data about chrome web storage.
Chrome Web Storage Data
| Field | Description | Example |
|---|---|---|
UserName | User Name | Example value |
ProfileName | Profile Name | Example value |
BrowserName | Browser Name | Example value |
Key | Key | Example value |
Value | Value | Example value |
Path | Path | Example value |
Collection Method
This collector extracts web storage data from browser storage locations including local storage and session storage.
Forensic Value
Web storage analysis reveals cached application data, stored credentials, session information, and potential data exfiltration staging. Analysts can identify malicious website activity, stored authentication tokens, tracking identifiers, and sensitive data cached by compromised web applications.