Chrome Cookies

Overview

Evidence: Chrome Cookies Description: Collect Chrome Cookies Category: Applications Platform: linux Short Name: ccookies Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Browser cookies store session tokens, authentication credentials, user preferences, and tracking data. This data is essential for understanding authenticated sessions, tracking user activity across websites, and identifying session hijacking or credential theft.

Data Collected

This collector gathers structured data about chrome cookies.

Chrome Cookies Data

Field	Description	Example
UserName	User Name	Example value
BrowserName	Browser Name	Example value
ProfileName	Profile Name	Example value
Domain	Domain	Example value
Name	Name	Example value
Path	Path	Example value
Value	Value	Example value
IsSecure	Is Secure	123
IsHTTPOnly	Is HTTP Only	123
HasExpires	Has Expires	123
IsPersistent	Is Persistent	123
Priority	Priority	123
SameSite	Same Site	123
SourcePort	Source Port	123
SourceScheme	Source Scheme	123
CreationTime	Creation Time	2023-10-15 14:30:25+03:00
ExpiresTime	Expires Time	2023-10-15 14:30:25+03:00
LastAccessTime	Last Access Time	2023-10-15 14:30:25+03:00

Collection Method

This collector extracts cookies from the browser's Cookies database, including domain, name, value, path, expiration, and security flags.

Forensic Value

Cookie analysis reveals active sessions, authentication tokens, persistent tracking identifiers, and potential session hijacking. Investigators can identify stolen credentials, unauthorized access, and cross-site tracking used for reconnaissance or targeting.