Chrome Cookie Database

androidWeb ActivityDevice Extraction

Location

/data/data/com.android.chrome/app_chrome/Default/Cookies

Description

SQLite database storing browser cookies set by websites visited in Chrome. Each record contains the host domain, cookie name and value, creation timestamp, last access timestamp, expiration date, and flags for secure, httponly, and same-site attributes.

Forensic Value

Cookie records prove that the device accessed specific websites at specific times, even if browsing history entries have been deleted. The creation_utc and last_access_utc timestamps establish both first and most recent access to each domain. Session cookies from authenticated services confirm active logins to email providers, social media platforms, banking sites, and cloud services. Cookie values may contain session tokens, user identifiers, and tracking IDs that can be correlated with server-side logs.

Tools Required

Cellebrite UFEDALEAPPMagnet AXIOMDB Browser for SQLiteHindsight