Chrome Browsing History

Location

Description

SQLite database containing Chrome browser history including URLs visited, page titles, visit timestamps (in WebKit epoch format), visit duration, transition type (typed, link, redirect), and visit count. The database also includes keyword_search_terms table linking searches to their corresponding URL visits.

Forensic Value

Chrome history on Android provides a detailed record of web activity including search queries, visited sites, and browsing patterns. The visit_source field distinguishes between local visits and those synced from other devices in the same Google account, enabling cross-device activity correlation. The keyword_search_terms table directly associates search engine queries with timestamps, revealing investigative interests, research activity, or pre-offense planning. Redirect chains captured in visit transitions expose the full navigation path including intermediate URLs.

Tools Required

Collection Commands

adb pull /data/data/com.android.chrome/app_chrome/Default/History /forensics/output/

python3 aleapp.py -t tar -i /path/to/extraction -o /forensics/output/

adb pull /data/data/com.android.chrome/app_chrome/Default/ /forensics/chrome_profile/

Collection Constraints

• •Availability depends on Android version, OEM build, encryption state, privilege level, and whether the collection was logical, rooted, or full-filesystem. OEM-specific builds may move or rename stores.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References