hindsight icon indicating copy to clipboard operation
hindsight copied to clipboard

Published 20 hours ago • verified publisher icon obsidianforensics

FR: Add support for Chrome "SimpleCache"

Open obsidianforensics opened this issue 4 years ago • 0 comments

A different structure for Chrome caches has been slowly rolling out, and we should add support for parsing it. It's already in use in Windows Chrome "Code Cache" (https://dfir.blog/chrome-evolution/), macOS Chrome (since ~72 - https://github.com/obsidianforensics/hindsight/issues/65), and Linux Chrome for a while.

References:

  • libyal/dtformats#10
  • https://chromium.googlesource.com/chromium/src/net/+/master/disk_cache/simple/simple_entry_format.h#18

obsidianforensics avatar Jan 15 '21 01:01 obsidianforensics