Update Chrome.tkape

add snapshots
EricZimmerman · Apr 16, 2024 · a0a2a1d · a0a2a1d
1 parent 6ffa71d
commit a0a2a1d
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/Targets/Browsers/Chrome.tkape b/Targets/Browsers/Chrome.tkape
@@ -201,6 +201,12 @@ Targets:
  Path: C:\Users\%user%\AppData\Roaming\Microsoft\Protect\*\
  Recursive: true
  Comment: "Required for offline decryption"
+ -
+ Name: Chrome Snapshots Folder
+ Category: Communications
+ Path: C:\Users\%user%\AppData\Local\Google\Chrome\User Data\Snapshots\*\
+ Recursive: true
+ Comment: "Grabs folder that appears to have snapshots of Chrome SQLite DBs organized by version #."
 
 # Documentation
 # https://nasbench.medium.com/web-browsers-forensics-7e99940c579a