ccl_chrome_indexeddb
DFIRMindMaps
| ccl_chrome_indexeddb | DFIRMindMaps | |
|---|---|---|
| 1 | 3 | |
| 113 | 475 | |
| - | - | |
| 6.3 | 1.8 | |
| 9 days ago | over 1 year ago | |
| Python | ||
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ccl_chrome_indexeddb
-
Leveldb File Forensics
I would suggest using https://github.com/cclgroupltd/ccl_chrome_indexeddb/blob/master/dump_leveldb.py - it's worked well for me exploring different LevelDB stores I've run across. The syntax is like python dump_leveldb.py "input directory", where "input directory" is the folder containing all the LevelDB files (.ldb, .sst, .log, LOG, LOCK, MANIFEST-*, etc). It outputs everything in a CSV ( and includes deleted values, which can be interesting).
DFIRMindMaps
What are some alternatives?
Leveldb-py - Leveldb Dumper/Viewer
awesome-incident-response - A curated list of tools for incident response
ChromeController - Comprehensive wrapper and execution manager for the Chrome browser using the Chrome Debugging Protocol.
RecuperaBit - A tool for forensic file system reconstruction.
LevelDB - LevelDB is a fast key-value storage library written at Google that provides an ordered mapping from string keys to string values.
KapeFiles - This repository serves as a place for community created Targets and Modules for use with KAPE.
LevelDBViewer - A Java program provides ablities to access & edit leveldb database
sysmon-config - Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
forensicsim - A forensic open-source parser module for Autopsy that allows extracting the messages, comments, posts, contacts, calendar entries and reactions from a Microsoft Teams IndexedDB LevelDB database.
EventTranscript.db-Research - A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.
selenium-python-helium - Lighter web automation for Python [Moved to: https://github.com/mherrmann/helium]
Loki - Loki - Simple IOC and YARA Scanner