Chrome Autofill Data (Web Data)

Location

Description

SQLite database storing Chrome autofill form data including names, email addresses, phone numbers, physical addresses, and custom form field entries that the user saved or allowed Chrome to remember. The autofill table contains field name-value pairs with usage counts and timestamps of first and last use.

Forensic Value

Autofill data reveals personal information the user entered into web forms, often including alternate identities, shipping addresses, email addresses, and phone numbers that may not appear elsewhere on the device. The date_created and date_last_used fields establish when specific form data was first saved and most recently reused. Usage counts indicate how frequently certain values were entered. Credit card metadata (without full numbers) stored in the credit_cards table can corroborate financial transactions and identity information.

Tools Required

Collection Commands

adb pull "/data/data/com.android.chrome/app_chrome/Default/Web Data" /forensics/output/

python3 aleapp.py -t tar -i /path/to/extraction -o /forensics/output/

adb pull /data/data/com.android.chrome/app_chrome/Default/ /forensics/chrome_profile/

Collection Constraints

• •Availability depends on Android version, OEM build, encryption state, privilege level, and whether the collection was logical, rooted, or full-filesystem. OEM-specific builds may move or rename stores.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References