Hi, all,
New to the forum (and DF) so go easy on me!
I was using various tools, including Autopsy to review a snapshot taken by KAPE by someone else. I was specifically looking at browser bookmarks and was noticing a pattern and wanted to notify folks for their benefit and also seek guidance on if and how this can be shared with devs to remediate.
Specifically, bookmarks saved under the Chrome folder “Mobile bookmarks” do not show up under analysis (they show up if you just open the “Bookmark” JSON file in any text editor). This folder is the default folder where bookmarks from the chrome mobile app gets stored. If a user syncs their content from their mobile to another computer through their chrome account, these get moved over, but again, do not show up when scanned.
I wondered whether this was by design given that it might be assumed that these artifacts didn’t originate on said device or whether this was an oversight. Another tool dev said they didn’t include it as they didn’t have any entries in the “Mobile Bookmarks” folder at the time of testing and so it got missed and will add it, so wonder if it the same applies with Autopsy.
Hope all the above made sense! Please share your thoughts.
Thanks!