Chromium Sessions rule (https://sqlitehunter.velocidex.com/docs/rules/#session) has the following identify query
SQLiteIdentifyQuery: |
SELECT count(*) AS `Check`
FROM sqlite_master WHERE type='table' AND (name='cookies' OR name='meta');
However, the session files are SNSS files and not SQLite. The SQL mentioned in the above-linked documentation points to Cookies table being used for Sessions artifact.
Has there been a mix up or am I interpreting it wrong?
Chromium Sessions rule (https://sqlitehunter.velocidex.com/docs/rules/#session) has the following identify query
However, the session files are SNSS files and not SQLite. The SQL mentioned in the above-linked documentation points to Cookies table being used for Sessions artifact.
Has there been a mix up or am I interpreting it wrong?