Browser Autopsy v1

Browser Autopsy v1.0.0

Offline forensic analyzer for Chrome and Firefox browser artifacts,
built for DFIR investigations.

Features

Extraction

• Chrome (History SQLite) and Firefox (places.sqlite) support
• Browsing history — per-visit timestamps, not just last-visit
• Downloads — target path, file size, state, redirect chains
• Search queries — auto-detected from 9 engines: Google, Bing, DuckDuckGo,
  Yahoo, YouTube, Ecosia, Brave, Startpage, Yandex

Forensic integrity

• Every source file is SHA-256 hashed before parsing — hash propagates
  through every derived event
• Source database is copied to temp before opening (WAL/SHM included);
  the original is never modified

Anomaly detection via configurable IOC YAML

• Suspicious domains (exact + wildcard *.tld)
• Suspicious file extensions, including double-extension trick (invoice.pdf.exe)
• Suspicious search keywords

Reporting

• Self-contained HTML report — print-friendly, renders as clean A4 PDF
• CSV exports: full timeline + anomalies-only (UTF-8 BOM for Excel)
• Suspicious file extensions, including double-extension trick (invoice.pdf.exe)
• Suspicious search keywords

Reporting

• Self-contained HTML report — print-friendly, renders as clean A4 PDF
• CSV exports: full timeline + anomalies-only (UTF-8 BOM for Excel)
• Time-window filtering (--start / --end) to narrow analysis to an incident window

Platform support

• Windows, Linux, macOS
• Python 3.10+

Quick start

pip install -r requirements.txt
python main.py --chrome-profile /path/to/chrome/Default --case-id INC-2024-001

Reports land in ./output/. See README for full usage and IOC configuration.

Try with sample data

The repo ships with anonymized artifacts simulating a suspicious
insider-activity incident:

python samples/generate.py
python main.py --chrome-profile samples/chrome --firefox-profile samples/firefox \
               --case-id INC-2026-03-14 --output-dir output/demo

---