Dump Edge Preferences
Overview
Section titled “Overview”Evidence: Dump Edge Preferences
Description: Dump Edge Preferences
Category: Applications
Platform: macos
Short Name: eprefs
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Browser preference files store sign-in, sync, and per-profile settings. During an infostealer investigation they show whether a browser profile was signed in, whether sync was enabled, and which account settings the browser stored.
This browser keeps Preferences and Secure Preferences in each profile.
Data Collected
Section titled “Data Collected”The collector copies the preference files into the acquired evidence. It does not parse them into Investigation Hub tables.
Collection Method
Section titled “Collection Method”The collector copies these files when they exist:
/Users/*/Library/Application Support/Microsoft Edge/*/Preferences/Users/*/Library/Application Support/Microsoft Edge/*/Secure Preferences
Forensic Value
Section titled “Forensic Value”The copied files let an analyst inspect sync status, signed-in accounts, and related browser settings from the evidence itself.
Preference files can contain account identifiers and sync settings. Handle them with the same access controls as other browser evidence.