Arc Favicons
Overview
Section titled “Overview”Evidence: Arc Favicons
Description: Collect Arc Favicons
Category: Applications
Platform: macos
Short Name: afico
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”Browsers cache the icon of each page they render and record which page the icon belongs to. The favicon database is kept apart from browsing history, so its page URLs corroborate visits from a second source.
Data Collected
Section titled “Data Collected”This collector gathers structured data about arc favicons.
Arc Favicons Data
Section titled “Arc Favicons Data”| Field | Description | Example |
|---|---|---|
ID | ID | 123 |
UserName | User Name | Example value |
BrowserName | Browser Name | Example value |
Profile | Profile | Example value |
URL | URL | Example value |
IconType | Icon Type | 123 |
Path | Path | Example value |
PageURL | Page the icon belongs to | https://example.com/page |
LastUpdated | Chromium icon time, in UTC. Empty for Firefox and Safari | 2023-10-15 14:30:25+03:00 |
ExpiresAt | Firefox mapping expiry, in UTC. Empty for other browsers | 2023-10-15 14:30:25+03:00 |
IconTimestamp | Safari icon time, in UTC. Empty for other browsers | 2023-10-15 14:30:25+03:00 |
Collection Method
Section titled “Collection Method”This collector copies the favicon database and its -wal, -shm, and -journal companions into the case, then parses each icon into the page URL it belongs to and the icon URL.
Forensic Value
Section titled “Forensic Value”Page and icon URL pairs show which pages the browser loaded, including full URLs with query strings, and can be correlated with history, downloads, and other browser artifacts. Clearing history in the browser also removes matching favicon data.