FileZilla Sessions

Overview

Evidence: FileZilla Sessions Description: Collect FileZilla Sessions & Site Manager Settings Category: Applications Platform: windows Short Name: flz Is Parsed: No Sent to Investigation Hub: No Collect File(s): Yes

Background

FileZilla FTP client stores server configurations, connection history, and transfer logs in XML and SQLite database files. These files contain FTP/SFTP server credentials, connection details, and file transfer history.

Data Collected

This collector gathers structured data about filezilla sessions.

Collection Method

This collector gathers FileZilla configuration XML files, site manager XML files, and SQLite databases from the Roaming profile containing server configurations and connection history.

Forensic Value

FileZilla artifacts reveal FTP servers accessed, credentials (often stored in plaintext), file transfer activities, and remote server connections. This is critical for investigating data exfiltration, unauthorized server access, and identifying compromised credentials.