Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Profile: modules/browser/all-browsers.toml

Source

  • Original path: profiles/modules/browser/all-browsers.toml

Profile (TOML)

# All Browsers Compound Module
# Combines all browser artifact modules

[module]
name = "All Browser Artifacts"
description = "Comprehensive browser artifact collection (Chrome, Firefox, Edge, Safari)"
category = "browser"
platform = ["windows", "linux", "macos"]
priority = "high"

# Include individual browser modules
includes = [
  "chrome.toml",
  "firefox.toml",
  "edge.toml",
  "safari.toml"
]

# Additional cross-browser patterns
[[patterns]]
  name = "Browser SQLite Database"
  pattern = "\\.(sqlite|db)$"
  case-insensitive = true
  type = "regex"

[[patterns]]
  name = "Browser JSON Data"
  pattern = "(?:history|bookmarks|cookies|logins|preferences)\\.json"
  case-insensitive = true
  type = "regex"

# Signatures for browser artifacts
[[signatures]]
  name = "Multiple Browser Artifacts"
  query = "SELECT sha256, COUNT(DISTINCT pattern_name) as browser_artifacts FROM pattern_matches WHERE pattern_name LIKE '%Browser%' OR pattern_name LIKE '%Chrome%' OR pattern_name LIKE '%Firefox%' OR pattern_name LIKE '%Edge%' OR pattern_name LIKE '%Safari%' GROUP BY sha256 HAVING browser_artifacts > 3"