browser-forensic¶

Parse Chrome, Firefox, and Safari — and embedded-Chromium apps — into one JSON timeline. Detect history clearing. Carve deleted records. No runtime deps.

cargo install --git https://github.com/SecurityRonin/browser-forensic browser-forensic-cli
br4n6 investigate /mnt/evidence/Users/jsmith

GitHub Repository →

What it does¶

br4n6 parses browser artifacts from Chrome, Firefox, and Safari — history, cookies, downloads, bookmarks, extensions, autofill, login metadata, cache, session state, preferences, and web storage (Local / Session Storage, IndexedDB) — and outputs a consistent JSON event stream regardless of which browser produced the data.

Beyond parsing, it detects structural integrity anomalies that indicate history was cleared or records were tampered with, carves deleted records from SQLite free pages and WAL files, interprets search terms and tracking cookies, scans raw memory byte sequences for URL and cookie patterns, and sweeps an evidence tree for embedded-Chromium containers (Electron / WebView2 / CEF apps such as Slack, Teams, and OneDrive).

Quick start¶

# The golden path — bounded, ranked, court-safe triage (or bare `br4n6 <PATH>`)
br4n6 investigate /mnt/evidence/Users/jsmith

# Did they touch X? — provenance-tagged hits across every source
br4n6 find evil.com /mnt/evidence/Users/jsmith

# Parse one artifact — the 46 primitives live under `artifact <name>`
br4n6 artifact history /path/to/Chrome/Default/History --format jsonl
br4n6 artifact storage /path/to/Chrome/Default --format jsonl

# Detect tampering indicators
br4n6 integrity /path/to/Chrome/Default/History --format jsonl

# Recover deleted / carved / evicted evidence — one orchestrator
br4n6 recover /path/to/Chrome/Default/History --format jsonl

# Sweep an evidence tree for browsers AND embedded-Chromium apps
br4n6 browsers --sweep /mnt/evidence/Users/jsmith --format jsonl

# A reproducible court/exam bundle (html + xlsx + jsonl + manifest + hashes)
br4n6 report /mnt/evidence/Users/jsmith --bundle -o ./case-42

Upgrading from the old flat commands? See Migrating to v2.

Browser coverage¶

Artifact	Chrome / Chromium¹	Firefox	Safari
History	✓	✓	✓
Cookies	✓	✓	✓
Downloads	✓	✓	✓
Bookmarks	✓	✓	✓
Extensions / Add-ons	✓	✓	✓
Autofill	✓	✓	—
Login Data (no passwords)	✓	✓	—
Cache	✓	✓	—
Session State	✓	✓	—
Preferences	✓	✓	—
Top Sites	—	—	✓
Profile Metadata	✓	—	—
Web Storage (Local / Session / IndexedDB)	✓	✓	—
Integrity indicators	✓	✓	✓
SQLite free-page carving	✓	✓	✓
WAL recovery	✓	✓	✓

¹ Chromium-family covers Chrome, Edge, Brave, Opera, Vivaldi, and Arc — one engine, one set of parsers.

Crate map¶

Crate	Description
`browser-forensic-core`	Domain types, timestamp conversions, ForensicMeta
`browser-forensic-chrome`	Chromium artifact parsers (Chrome, Edge, Brave, Opera, Vivaldi, Arc)
`browser-forensic-firefox`	Firefox artifact parsers
`browser-forensic-safari`	Safari artifact parsers
`browser-forensic-discovery`	Profile discovery + embedded-Chromium container sweep
`browser-forensic-storage`	Web storage — Local / Session Storage, IndexedDB (reuses `leveldb-forensic`)
`browser-forensic-integrity`	Tampering and clearing detection
`browser-forensic-carve`	SQLite free-page and WAL recovery (via `sqlite-forensic`)
`browser-forensic-interpret`	Search-term / tracking-cookie / query-string interpretation
`browser-forensic-memory`	Byte-pattern URL/cookie scanning
`browser-forensic-triage`	Triage orchestration → `TriageReport`
`browser-forensic-cli`	`br4n6` dual-mode CLI + TUI binary
`browser-forensic-mcp`	History/state MCP server for AI agents (PII-redacted, no secret readers)

RapidTriage ecosystem¶

browser-forensic is the browser parser in the RapidTriage DFIR toolkit alongside winevt-forensic, srum-forensic, memory-forensic, and forensicnomicon.