Skip to content

Say why each flagged Source File column stays #318

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abrignoni merged 1 commit into from
Sep 27, 2026
Merged

Say why each flagged Source File column stays #318

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions scripts/artifacts/chromiumAutofill.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,10 @@
"read; none of the tested "
"databases lacked them. Browser, Profile and User come from the path: the browser from "
"the user data folder, the profile from the folder inside it, and the user from the home "
"folder that holds it; Source File names the file each row came from, so rows from two "
"profiles or two users stay apart. A profile under User Data/Snapshots/<version>/ is "
"folder that holds it; Source File names the file each row came from, since "
"Browser, Profile and User do not separate two copies of one profile, which a "
"logical extraction can hold under Users/ and System/Volumes/Data/Users/. A "
"profile under User Data/Snapshots/<version>/ is "
"reported with that path as its Profile, so a snapshot copy is not merged with the live "
"profile; no registered image carries one, and that branch was exercised on a constructed "
"tree only. Created and Last Used are date_created and date_last_used, seconds since "
Expand Down
6 changes: 4 additions & 2 deletions scripts/artifacts/chromiumBookmarks.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,10 @@
"https://github.com/chromium/chromium/blob/abb5172872b726072a64dfabaf45894c6ecf7369/base/time/time.h#L5-L7); "
"Date Last Used is blank where the file has no value or 0. Browser, Profile and User come "
"from the path: the browser from the user data folder, the profile from the folder inside "
"it, and the user from the home folder that holds it; Source File names the file each row "
"came from, so rows from two profiles or two users stay apart. A profile under User "
"it, and the user from the home folder that holds it; Source File names the file "
"each row came from, since Browser, Profile and User do not separate two copies "
"of one profile, which a logical extraction can hold under Users/ and "
"System/Volumes/Data/Users/. A profile under User "
"Data/Snapshots/<version>/ is reported with that path as its Profile, so a snapshot copy "
"is not merged with the live profile; no registered image carries one, and that branch "
"was exercised on a constructed tree only. No registered image produced a row: the one "
Expand Down
6 changes: 4 additions & 2 deletions scripts/artifacts/chromiumCookies.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,10 @@
"and every cookie row of the tested images had an empty value and a non-empty "
"encrypted_value: 840 on pc_mus_001_win11 and 2953 on lonewolf_win10. Browser, Profile "
"and User come from the path: the browser from the user data folder, the profile from the "
"folder inside it, and the user from the home folder that holds it; Source File names the "
"file each row came from, so rows from two profiles or two users stay apart. A profile "
"folder inside it, and the user from the home folder that holds it; Source File "
"names the file each row came from, since Browser, Profile and User do not "
"separate two copies of one profile, which a logical extraction can hold under "
"Users/ and System/Volumes/Data/Users/. A profile "
"under User Data/Snapshots/<version>/ is reported with that path as its Profile, so a "
"snapshot copy is not merged with the live profile; no registered image carries one, and "
"that branch was exercised on a constructed tree only. Created, Expires, Last Access Time "
Expand Down
6 changes: 4 additions & 2 deletions scripts/artifacts/chromiumExtensions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,10 @@
"pc_mus_001_win11 and 10 on lonewolf_win10, and 20 entries with no location in the "
"Microsoft Edge Secure Preferences of pc_mus_001_win11. Browser, Profile and User come "
"from the path: the browser from the user data folder, the profile from the folder inside "
"it, and the user from the home folder that holds it; Source File names the file each row "
"came from, so rows from two profiles or two users stay apart. A profile under User "
"it, and the user from the home folder that holds it; Source File names the file "
"each row came from, since Browser, Profile and User do not separate two copies "
"of one profile, which a logical extraction can hold under Users/ and "
"System/Volumes/Data/Users/. A profile under User "
"Data/Snapshots/<version>/ is reported with that path as its Profile, so a snapshot copy "
"is not merged with the live profile; no registered image carries one, and that branch "
"was exercised on a constructed tree only. Name and Version are the name and version of "
Expand Down
24 changes: 16 additions & 8 deletions scripts/artifacts/chromiumHistory.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@
"joins each visit to its urls row for the URL and title; one row per visits row. Every "
"visit on the tested images had a urls row. Browser, Profile and User come from the path: "
"the browser from the user data folder, the profile from the folder inside it, and the "
"user from the home folder that holds it; Source File names the file each row came from, "
"so rows from two profiles or two users stay apart. A profile under User "
"user from the home folder that holds it; Source File names the file each row "
"came from, since Browser, Profile and User do not separate two copies of one "
"profile, which a logical extraction can hold under Users/ and "
"System/Volumes/Data/Users/. A profile under User "
"Data/Snapshots/<version>/ is reported with that path as its Profile, so a snapshot copy "
"is not merged with the live profile; no registered image carries one, and that branch "
"was exercised on a constructed tree only. Visit Time is visits.visit_time, microseconds "
Expand Down Expand Up @@ -142,8 +144,10 @@
"row per urls row. On the tested images every urls row had at least one visits row, so "
"this artifact names no URL that Chromium Web Visits does not. Browser, Profile and User "
"come from the path: the browser from the user data folder, the profile from the folder "
"inside it, and the user from the home folder that holds it; Source File names the file "
"each row came from, so rows from two profiles or two users stay apart. A profile under "
"inside it, and the user from the home folder that holds it; Source File names "
"the file each row came from, since Browser, Profile and User do not separate two"
" copies of one profile, which a logical extraction can hold under Users/ and "
"System/Volumes/Data/Users/. A profile under "
"User Data/Snapshots/<version>/ is reported with that path as its Profile, so a snapshot "
"copy is not merged with the live profile; no registered image carries one, and that "
"branch was exercised on a constructed tree only. Last Visit Time is "
Expand Down Expand Up @@ -247,8 +251,10 @@
"notes": "Reads the downloads table of each History database in a Chromium-based browser profile, "
"with the URL chain from downloads_url_chains; one row per downloads row. Browser, "
"Profile and User come from the path: the browser from the user data folder, the profile "
"from the folder inside it, and the user from the home folder that holds it; Source File "
"names the file each row came from, so rows from two profiles or two users stay apart. A "
"from the folder inside it, and the user from the home folder that holds it; "
"Source File names the file each row came from, since Browser, Profile and User "
"do not separate two copies of one profile, which a logical extraction can hold "
"under Users/ and System/Volumes/Data/Users/. A "
"profile under User Data/Snapshots/<version>/ is reported with that path as its Profile, "
"so a snapshot copy is not merged with the live profile; no registered image carries one, "
"and that branch was exercised on a constructed tree only. Start Time, End Time and Last "
Expand Down Expand Up @@ -395,8 +401,10 @@
"Data of each profile whose History was read, where that Web Data's keywords "
"table was read. Browser, Profile and User come from the path: the "
"browser from the user data folder, the profile from the folder inside it, and the user "
"from the home folder that holds it; Source File names the file each row came from, so "
"rows from two profiles or two users stay apart. A profile under User "
"from the home folder that holds it; Source File names the file each row came "
"from, since Browser, Profile and User do not separate two copies of one profile,"
" which a logical extraction can hold under Users/ and "
"System/Volumes/Data/Users/. A profile under User "
"Data/Snapshots/<version>/ is reported with that path as its Profile, so a snapshot copy "
"is not merged with the live profile; no registered image carries one, and that branch "
"was exercised on a constructed tree only. A database left with a rollback journal that "
Expand Down
6 changes: 4 additions & 2 deletions scripts/artifacts/chromiumLoginData.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,10 @@
"one row per logins row, and Store names the file. The password_value column is not "
"queried. Browser, Profile and User come from the path: the browser from the user data "
"folder, the profile from the folder inside it, and the user from the home folder that "
"holds it; Source File names the file each row came from, so rows from two profiles or "
"two users stay apart. A profile under User Data/Snapshots/<version>/ is reported with "
"holds it; Source File names the file each row came from, since Browser, Profile "
"and User do not separate two copies of one profile, which a logical extraction "
"can hold under Users/ and System/Volumes/Data/Users/. A profile under User "
"Data/Snapshots/<version>/ is reported with "
"that path as its Profile, so a snapshot copy is not merged with the live profile; no "
"registered image carries one, and that branch was exercised on a constructed tree only. "
"Created, Last Used and Password Modified are date_created, date_last_used and "
Expand Down
12 changes: 8 additions & 4 deletions scripts/artifacts/chromiumTopSites.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,10 @@
"current releases, or the thumbnails table the Chrome 65 release kept instead; one row "
"per table row. Browser, Profile and User come from the path: the browser from the user "
"data folder, the profile from the folder inside it, and the user from the home folder "
"that holds it; Source File names the file each row came from, so rows from two profiles "
"or two users stay apart. A profile under User Data/Snapshots/<version>/ is reported with "
"that holds it; Source File names the file each row came from, since Browser, "
"Profile and User do not separate two copies of one profile, which a logical "
"extraction can hold under Users/ and System/Volumes/Data/Users/. A profile under"
" User Data/Snapshots/<version>/ is reported with "
"that path as its Profile, so a snapshot copy is not merged with the live profile; no "
"registered image carries one, and that branch was exercised on a constructed tree only. "
"Rank is url_rank as stored. The current source describes it as a 0-based index where the "
Expand Down Expand Up @@ -110,8 +112,10 @@
"notes": "Reads the omni_box_shortcuts table of each Chromium-based browser profile's Shortcuts "
"database; one row per table row. Browser, Profile and User come from the path: the "
"browser from the user data folder, the profile from the folder inside it, and the user "
"from the home folder that holds it; Source File names the file each row came from, so "
"rows from two profiles or two users stay apart. A profile under User "
"from the home folder that holds it; Source File names the file each row came "
"from, since Browser, Profile and User do not separate two copies of one profile,"
" which a logical extraction can hold under Users/ and "
"System/Volumes/Data/Users/. A profile under User "
"Data/Snapshots/<version>/ is reported with that path as its Profile, so a snapshot copy "
"is not merged with the live profile; no registered image carries one, and that branch "
"was exercised on a constructed tree only. Last Access Time is last_access_time, "
Expand Down
Loading
Loading