Chrome Bookmarks

Overview

Evidence: Chrome Bookmarks Description: Collect Chrome Bookmarks Category: Applications Platform: macos Short Name: cbkmrks Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Browser bookmarks represent user-saved favorite websites and organizational folders. This data reveals frequently accessed sites, user interests, and potential indicators of reconnaissance, phishing targets, or suspicious infrastructure.

Data Collected

This collector gathers structured data about chrome bookmarks.

Chrome Bookmarks Data

Field	Description	Example
UserName	User Name	Example value
ProfileName	Profile Name	Example value
BrowserName	Browser Name	Example value
GUID	GUID	Example value
BookmarkID	Bookmark ID	Example value
Name	Name	Example value
Type	Type	Example value
URL	URL	Example value
ParentFolder	Parent Folder	Example value
DateAdded	Date Added	2023-10-15 14:30:25+03:00
DateLastUsed	Date Last Used	2023-10-15 14:30:25+03:00
DateModified	Date Modified	2023-10-15 14:30:25+03:00

Collection Method

This collector parses the browser's Bookmarks file to extract saved URLs, folder structures, timestamps, and metadata.

Forensic Value

Bookmark analysis identifies targeted websites, phishing pages, command-and-control servers, internal resources, and organizational reconnaissance patterns. Investigators can detect social engineering campaigns, credential harvesting attempts, and lateral movement preparation.