Analyzing Browser Forensics With Hindsight

import sqlite3import osimport jsonimport sysfrom datetime import datetime, timedelta
CHROME_EPOCH = datetime(1601, 1, 1)
def chrome_time_to_datetime(chrome_ts: int):    """Convert Chrome timestamp to datetime."""    if chrome_ts == 0:        return None    try:        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)    except (OverflowError, OSError):        return None
def analyze_chrome_history(profile_path: str, output_dir: str) -> dict:    """Analyze Chrome History database for forensic evidence."""    history_db = os.path.join(profile_path, "History")    if not os.path.exists(history_db):        return {"error": "History database not found"}
    os.makedirs(output_dir, exist_ok=True)    conn = sqlite3.connect(f"file:{history_db}?mode=ro", uri=True)
    # URL visits with timestamps    cursor = conn.cursor()    cursor.execute("""        SELECT u.url, u.title, v.visit_time, u.visit_count,               v.transition & 0xFF as transition_type        FROM visits v JOIN urls u ON v.url = u.id        ORDER BY v.visit_time DESC LIMIT 5000    """)    visits = [{        "url": r[0], "title": r[1],        "visit_time": str(chrome_time_to_datetime(r[2])),        "total_visits": r[3], "transition": r[4]    } for r in cursor.fetchall()]
    # Downloads    cursor.execute("""        SELECT target_path, tab_url, start_time, end_time,               received_bytes, total_bytes, mime_type, state        FROM downloads ORDER BY start_time DESC LIMIT 1000    """)    downloads = [{        "path": r[0], "source_url": r[1],        "start_time": str(chrome_time_to_datetime(r[2])),        "end_time": str(chrome_time_to_datetime(r[3])),        "received_bytes": r[4], "total_bytes": r[5],        "mime_type": r[6], "state": r[7]    } for r in cursor.fetchall()]
    # Keyword searches    cursor.execute("""        SELECT k.term, u.url, k.url_id        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id        ORDER BY u.last_visit_time DESC LIMIT 1000    """)    searches = [{"term": r[0], "url": r[1]} for r in cursor.fetchall()]
    conn.close()
    report = {        "analysis_timestamp": datetime.now().isoformat(),        "profile_path": profile_path,        "total_visits": len(visits),        "total_downloads": len(downloads),        "total_searches": len(searches),        "visits": visits,        "downloads": downloads,        "searches": searches    }
    report_path = os.path.join(output_dir, "browser_forensics.json")    with open(report_path, "w") as f:        json.dump(report, f, indent=2)
    return report
def main():    if len(sys.argv) < 3:        print("Usage: python process.py <chrome_profile_path> <output_dir>")        sys.exit(1)    analyze_chrome_history(sys.argv[1], sys.argv[2])
if __name__ == "__main__":    main()