Chromium Cookies

Overview

Evidence: Chromium Cookies Description: Collect Chromium Cookies Category: Browser Platform: Linux Short Name: chcookies Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Cookies store session state and tracking data used by websites. They are valuable for reconstructing user sessions and authentication state.

Data Collected

This collector gathers structured data about cookies.

Chromium Cookies Data

Field	Description	Example
ID	Primary key (auto-increment)	1
HostKey	Cookie domain	.example.com
Name	Cookie name	sessionid
Value	Cookie value (masked/decrypted if available)	********
Path	Cookie path	/
IsSecure	Secure flag	true
Expires	Expiry time	2023-10-15 14:30:25
CookiesPath	Source database path	/home/user/.config/chromium/Default/Cookies

Collection Method

This collector parses the necessary data from the browser_cookies table.

Usage

Correlate cookies with login data and history to reconstruct sessions and potential account use.

Notes

Decryption may require OS keyrings; availability varies by environment.