Chromium Form History

Overview

Evidence: Chromium Form History Description: Collect Chromium Form History Category: Browser Platform: Linux Short Name: chfh Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Records of entered values in forms (e.g., search queries) reveal user intent and actions.

Data Collected

This collector gathers structured data about form history.

Chromium Form History Data

Field	Description	Example
ID	Primary key (auto-increment)	1
Name	Form field name	q
Value	Entered value	binalyze
Count	Usage count	2
LastUsedTime	Last used timestamp	2023-10-15 14:30:25
WebDataPath	Source database path	/home/user/.config/chromium/Default/Web Data

Collection Method

This collector parses the necessary data from the browser_form_history table.

Usage

Correlate with browsing and downloads to trace user-driven flows.

Notes

Treat sensitive values appropriately per policy.