Forensic: Extracting the passwords registered in the browser

Friends, how are you? I came to you in the forensic analysis with something very important, which is extracting the passwords registered in the browser. As I talked before about the history file, we will talk about a file that is no less important than it, which is the Web Data file, which is located in this path:

C:\Users\-------\AppData\Local\Google\Chrome\User Data\Default 

Or you can of course use the everything tool and what it does in terms of a quick search. We will search, as we talked about it previously in the last lesson, about the file:

Now we take a copy of this file and put it away for dissection. We will open this file using sqlite-tool.

:After downloading and decompressing you will find 3 files

Paste the Web Data file with them.

replace the path of decomressed folder in windows explore with cmd then press Enter

Now we will call the file using the sqlite3.exe .

after press Enter:

 To know the tables in that file, we write the command: .tables or .ta

Now we will give some sql query:

Note: Please don't forget to put the semi-colon because of it the white hair appeared

after press Enter:

Written By : Ammar Yasser