Repolode
Submit
ChmaraX

ChmaraX/forensix

Forensic tool that mounts, analyzes and visualizes Google Chrome browser artifacts such as history, downloads, logins and cache.

View on GitHub
Stars
285
Forks
43
Open issues
102
Last commit
2 months ago

What is it?

ForensiX is a forensic tool for processing Google Chrome profile data. It mounts a copy of a Chrome data volume in read-only mode and checks hashes to preserve the integrity of the evidence during analysis.

The tool parses browsing history (including transition types and visit durations), login data, autofill entries, downloads, bookmarks, favicons and the browser cache. It also estimates a profile's personal details and activity patterns, such as most visited sites, time-of-day browsing heatmaps, and URL category classification using an ML model.

The project runs as a Docker Compose stack with a Node.js server, a web UI on port 3000 and MongoDB, and can also be run manually with Python and Node.js dependencies. It supports optional HTTPS for the UI and server connection.

Key features

  • 01Mounts Chrome data read-only and verifies hashes to preserve integrity
  • 02Parses browsing history, visit durations and transition types
  • 03Recovers logins, autofill entries, downloads, bookmarks and favicons
  • 04Inspects the browser cache, including URLs, content types and payloads
  • 05Classifies visited URLs into categories with an ML model
  • 06Visualizes activity over time with heatmaps and bar charts

Use cases

  • Digital forensic investigations of a seized Chrome or Chromium-based browser profile
  • Reviewing browsing and download history for incident response
  • Teaching or researching browser artifact analysis

Quick start

  1. 1

    Clone the repository

    git clone https://github.com/ChmaraX/forensix.git
  2. 2

    Enter the project directory

    cd forensix
  3. 3

    Copy your Chrome or Brave browser data into the data directory

    cp -r "/Users/username/Library/Application Support/Google/Chrome/Default/." ./data/
  4. 4

    Build and start the application with Docker Compose

    docker-compose up --build

Things to know

  • Requires Docker and Docker Compose, and the first build downloads a roughly 700MB ML model.
  • The README's examples use macOS paths for browser data, so other platforms need adjusted paths.

Topics

#forensics#browser-forensics#chrome#browsing-history#digital-forensics#data-visualization#docker#browsing-activity#cache#forensic-analysis

FAQ

What is forensix?
Forensic tool that mounts, analyzes and visualizes Google Chrome browser artifacts such as history, downloads, logins and cache. ForensiX is a forensic tool for processing Google Chrome profile data. It mounts a copy of a Chrome data volume in read-only mode and checks hashes to preserve the integrity of the evidence during analysis.
Is forensix free to use? What license does it have?
forensix is open source under the MIT license. Check the license terms before using it in commercial products.
Is forensix still maintained?
Updated within 6 months. The last commit to forensix was on Aug 19, 2026.
What can I use forensix for?
Digital forensic investigations of a seized Chrome or Chromium-based browser profile Reviewing browsing and download history for incident response Teaching or researching browser artifact analysis
How do I install forensix?
Clone the repository: git clone https://github.com/ChmaraX/forensix.git Enter the project directory: cd forensix Copy your Chrome or Brave browser data into the data directory: cp -r "/Users/username/Library/Application Support/Google/Chrome/Default/." ./data/ Build and start the application with Docker Compose: docker-compose up --build
Where can I get forensix?
The source code and installation instructions are on GitHub: https://github.com/ChmaraX/forensix

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects