High-Fidelity Google Chrome Cache Inspector & User Data Forensics
The comprehensive story, binary architecture, and forensic engine of chrome2rust — developed by Andrew Paolucci to inspect modern Simple Cache and legacy Blockfile Cache streams, snapshot locked SQLite profiles with WAL/SHM sidecars, recover LevelDB and IndexedDB storage, and generate air-gapped forensic report bundles with native Model Context Protocol (MCP) server support for AI agents.
Dual-Backend HTTP Cache & Protocol Decompression
High-performance pure-Rust binary decoders designed to reconstruct web assets without running Chromium or executing untrusted client scripts.
Simple Cache Parser
Parses modern Chromium Simple Cache (*_0 and *_1 pairs). Reconstructs Stream 0 HTTP headers with EOF record validation, CRC-32 integrity checks, and key SHA-256 validation across Chromium versions through v156+.
Legacy Blockfile Engine
Parses legacy Blockfile stores (index hash table, data_0..data_3 allocation tables, external f_xxxxxx payload blobs, and RankingsNode LRU timestamps) with deleted-entry recovery heuristics.
HttpResponseInfo Decoder
Decodes Chromium's binary Pickle structures extracting raw HTTP response headers, request/response timestamps, network isolation partition keys (URL, Site, Frame), server socket IP:port, TLS versions, ALPN protocols, and X.509 certificate chains.
Transparent Multi-Codec Decompression
Transparently streams and decompresses gzip, deflate, br (Brotli), and zstd cached payloads on preview, SHA-256 calculation, and disk export while preserving raw archives when unencoded.
Deep Magic & Extension Recovery
Identifies 60+ binary signatures (PE, Mach-O, WOFF2, MP4, WebP, AVIF, PDF, SQLite, WASM), container inspection, and text heuristics. Recovers missing extensions and flags spoofed HTTP Content-Type vs. payload magic mismatches.
8-Format Structured Exporter
Exports cache metadata and extracted bodies in table, csv, tsv, text, html (tabular), vhtml (vertical forensic record cards), xml, and json with full URL path directory reconstruction.
Chrome User Data Forensic Suite
Safe, read-only analysis of live and locked Chromium profiles without locking SQLite databases or modifying live evidence files.
Safe WAL/SHM Read-Only Snapshots
Live browsers hold exclusive write locks on SQLite stores. chrome2rust creates temporary, memory-isolated snapshots alongside -wal, -shm, and -journal sidecars so live profiles are never touched or corrupted.
History & Deletion-Gap Auditing
Parses URLs, visit counts, and PageTransition redirect chains. Evaluates sqlite_sequence counter discrepancies against active table rows to estimate cleared/deleted browsing history entries.
Credentials & App-Bound Encryption
Categorizes cookie and login storage into plaintext, v10, v11, and modern Windows v20 App-Bound encryption schemes, offering optional best-effort decryption with user passphrases or hex keys.
Pure-Rust LevelDB & IndexedDB
Pure-Rust parser for Chromium LevelDB tables (.ldb blocks, Snappy/Zstd log replay, write-ahead log recovery) for Local Storage and Session Storage, alongside complete IndexedDB origin cataloging.
Deterministic Merkle Chain-of-Custody
Computes SHA-256 cryptographic digests across all profile artifacts and constructs a balanced RFC 6234 binary Merkle root, exported as verifiable JSON or CSV manifests (chrome2rust custody).
Air-Gapped Standalone Reports
Generates 100% self-contained HTML forensic reports (zero external CDN or web font requests), with interactive dark/light theme switching, SVG domain breakdown charts, sortable data tables, and exportable JSON bundles.
The 7 Workspace Crates
A clean separation of concerns, enabling headless server builds, standalone MCP servers, or full Win32 desktop console deployment.
tracing logging.chrome2rust-mcp binary exposing Chrome artifact inspection and forensics to AI workflows.chrome2rust): profiles, sniff, cache, analyze, report, custody, pick, gui, and mcp subcommands.chrome2rust-gui) featuring sunken Console Tree, Details ListView, and Classic Property Sheet inspectors. Zero WebView bloat.Model Context Protocol (MCP) Integration
Equip AI agents (Antigravity, Claude, Gemini, Cursor) with structured, programmatic tools to inspect Chromium profiles, trace web traffic, and verify evidence chain-of-custody.
| MCP Tool Name | Category | Description | Primary Arguments |
|---|---|---|---|
chrome2rust_profiles |
Discovery | Auto-discover installed Chromium browsers, profiles, and cache directories. | browser, all_users |
chrome2rust_sniff |
Classification | Classify unknown files by magic binary signature and identify Chrome artifact types. | path |
chrome2rust_cache_list |
HTTP Cache | Query, filter, and enumerate cached HTTP resources with sorting and hash options. | path, filter, content_type, limit |
chrome2rust_cache_inspect |
HTTP Cache | Retrieve full HTTP response headers, TLS/ALPN metadata, X.509 cert chains, and preview. | path, key, preview_bytes |
chrome2rust_cache_extract |
Extraction | Decompress and export cached resources reconstructing website directory paths. | path, output_dir, website_dirs |
chrome2rust_analyze |
Forensics | Execute complete read-only Chrome User Data forensic audit across all databases. | path, decrypt, key |
chrome2rust_report |
Reporting | Generate air-gapped forensic report bundles (HTML, JSON, Markdown). | path, format, output |
chrome2rust_custody |
Verification | Compute deterministic SHA-256 digests and RFC 6234 binary Merkle root manifest. | path, output |
{
"mcpServers": {
"chrome2rust": {
"command": "chrome2rust",
"args": ["mcp"],
"env": {
"RUST_LOG": "warn"
}
}
}
}Command-Line Interface Generator
Construct production-ready chrome2rust commands for cache extraction, deep analysis, and custody verification.
chrome2rust analyze "C:\Users\User\AppData\Local\Google\Chrome\User Data" --audit-manifest ./custody.csvPre-Compiled Standalone Binaries
Self-contained native executables with zero external runtime dependencies. Every archive includes chrome2rust (CLI), chrome2rust-gui (Win32/MMC Console), and chrome2rust-mcp (MCP Server).
Built for Forensic Precision
Developed by Andrew Paolucci as part of the GUAP (General Utilities & Application Protocols) open-source systems suite. Dedicated to creating high-performance, memory-safe, and mathematically verifiable tools that replace brittle scripting with robust binary implementations.