15 | mounted on: {props.volumeInfo.mount_point}
16 | mount options: {props.volumeInfo.mount_opts}
17 | 22 | integrity: {props.integrity.status} 23 | 24 |
25 | 26 | } 27 | /> 28 | 29 | ); 30 | } 31 | 32 | export default Volume; 33 | -------------------------------------------------------------------------------- /client/src/views/history/components/AvgVisitChart/AvgVisitChart.js: -------------------------------------------------------------------------------- 1 | import React from "react"; 2 | import { 3 | BarChart, 4 | Bar, 5 | XAxis, 6 | YAxis, 7 | CartesianGrid, 8 | Tooltip, 9 | ResponsiveContainer 10 | } from "recharts"; 11 | import { Header, Segment } from "semantic-ui-react"; 12 | import _ from "lodash"; 13 | 14 | function AvgVisitChart(props) { 15 | return ( 16 |
-
24 | {metadata?.map(data => {
25 | return
19 | Please set REACT_APP_GOOGLE_MAPS_API_KEY in your environment variables.
20 |
21 | Create a .env file in the client directory with:
22 |
23 | REACT_APP_GOOGLE_MAPS_API_KEY=your_api_key_here
24 |
No volumes available
49 | )} 50 |41 | Selected records will be stored in shared database with other 42 | investigators. 43 |
44 | 50 |
40 |
71 | );
72 | }
73 |
74 | export default TopBar;
75 |
--------------------------------------------------------------------------------
/client/src/views/volumes/VolumesContainer.js:
--------------------------------------------------------------------------------
1 | import React, { useState, useEffect } from "react";
2 | import { ResponsiveSunburst } from "@nivo/sunburst";
3 | import axios from "../../axios-api";
4 | import { Grid, Segment, Header } from "semantic-ui-react";
5 | import ContentWrapper from "../../layout/ContentWrapper/ContentWrapper";
6 | import ReactJson from "react-json-view";
7 | import { useDispatch, useSelector } from "react-redux";
8 | import { storeDirTreeData } from "../../store/actions/appData";
9 |
10 | function VolumesContainer() {
11 | const dispatch = useDispatch();
12 | const dirTreeData = useSelector(state => state.appDataReducer.dirTree);
13 | const [dirTree, setDirTree] = useState(dirTreeData);
14 |
15 | useEffect(() => {
16 | const token = localStorage.getItem("token");
17 |
18 | const config = {
19 | headers: { Authorization: `Bearer ${token}` }
20 | };
21 |
22 | if (!dirTreeData) {
23 | axios.get("/volumes/tree", config).then(res => {
24 | setDirTree(res.data);
25 | dispatch(storeDirTreeData(res.data));
26 | });
27 | }
28 | });
29 | return (
30 |
41 |
57 |
42 |
44 | Integrity:
45 | {fetching ? (
46 |
58 |
59 |
60 | dispatch(logout())} />
61 |
62 |
63 |
70 |
41 |
56 |
62 |
64 |
70 |
115 | );
116 | }
117 |
118 | export default withRouter(Sidemenu);
119 |
--------------------------------------------------------------------------------
/client/README.md:
--------------------------------------------------------------------------------
1 | This project was bootstrapped with [Create React App](https://github.com/facebook/create-react-app).
2 |
3 | ## Available Scripts
4 |
5 | In the project directory, you can run:
6 |
7 | ### `npm start`
8 |
9 | Runs the app in the development mode.
71 |
76 | 73 | Google Chrome forensics tool 74 |
75 |
77 |
78 | Navigation
79 | {" "}
80 | {nav.map(item => (
81 |
96 | More
97 |
98 | {navAlt.map(item => (
99 |
114 | selectItem(item)}
84 | className={`item ${
85 | props.history.location.pathname === item.path ? "selected" : null
86 | }`}
87 | >
88 |
94 | ))}
95 |
89 |
selectItem(item)}
102 | className={`item ${
103 | props.history.location.pathname === item.path ? "selected" : null
104 | }`}
105 | >
106 |
112 | ))}
113 |
107 |
10 | Open [http://localhost:3000](http://localhost:3000) to view it in the browser. 11 | 12 | The page will reload if you make edits.
13 | You will also see any lint errors in the console. 14 | 15 | ### `npm test` 16 | 17 | Launches the test runner in the interactive watch mode.
18 | See the section about [running tests](https://facebook.github.io/create-react-app/docs/running-tests) for more information. 19 | 20 | ### `npm run build` 21 | 22 | Builds the app for production to the `build` folder.
23 | It correctly bundles React in production mode and optimizes the build for the best performance. 24 | 25 | The build is minified and the filenames include the hashes.
26 | Your app is ready to be deployed! 27 | 28 | See the section about [deployment](https://facebook.github.io/create-react-app/docs/deployment) for more information. 29 | 30 | ### `npm run eject` 31 | 32 | **Note: this is a one-way operation. Once you `eject`, you can’t go back!** 33 | 34 | If you aren’t satisfied with the build tool and configuration choices, you can `eject` at any time. This command will remove the single build dependency from your project. 35 | 36 | Instead, it will copy all the configuration files and the transitive dependencies (Webpack, Babel, ESLint, etc) right into your project so you have full control over them. All of the commands except `eject` will still work, but they will point to the copied scripts so you can tweak them. At this point you’re on your own. 37 | 38 | You don’t have to ever use `eject`. The curated feature set is suitable for small and middle deployments, and you shouldn’t feel obligated to use this feature. However we understand that this tool wouldn’t be useful if you couldn’t customize it when you are ready for it. 39 | 40 | ## Learn More 41 | 42 | You can learn more in the [Create React App documentation](https://facebook.github.io/create-react-app/docs/getting-started). 43 | 44 | To learn React, check out the [React documentation](https://reactjs.org/). 45 | 46 | ### Code Splitting 47 | 48 | This section has moved here: https://facebook.github.io/create-react-app/docs/code-splitting 49 | 50 | ### Analyzing the Bundle Size 51 | 52 | This section has moved here: https://facebook.github.io/create-react-app/docs/analyzing-the-bundle-size 53 | 54 | ### Making a Progressive Web App 55 | 56 | This section has moved here: https://facebook.github.io/create-react-app/docs/making-a-progressive-web-app 57 | 58 | ### Advanced Configuration 59 | 60 | This section has moved here: https://facebook.github.io/create-react-app/docs/advanced-configuration 61 | 62 | ### Deployment 63 | 64 | This section has moved here: https://facebook.github.io/create-react-app/docs/deployment 65 | 66 | ### `npm run build` fails to minify 67 | 68 | This section has moved here: https://facebook.github.io/create-react-app/docs/troubleshooting#npm-run-build-fails-to-minify 69 | -------------------------------------------------------------------------------- /client/src/views/bookmarks/BookmarksContainer.js: -------------------------------------------------------------------------------- 1 | import React, { useState, useEffect } from "react"; 2 | import ContentWrapper from "../../layout/ContentWrapper/ContentWrapper"; 3 | import SaveEvidenceModal from "../../common/SaveEvidenceModal/SaveEvidenceModal"; 4 | import MaterialTable from "material-table"; 5 | import { MuiThemeProvider, createMuiTheme } from "@material-ui/core"; 6 | import { Header } from "semantic-ui-react"; 7 | import axios from "../../axios-api"; 8 | import { useDispatch, useSelector } from "react-redux"; 9 | import { storeBookmarksData } from "../../store/actions/appData"; 10 | 11 | const theme = createMuiTheme({ 12 | palette: { 13 | primary: { 14 | main: "rgb(111, 156, 235)" 15 | }, 16 | secondary: { 17 | main: "rgb(111, 156, 235)" 18 | } 19 | } 20 | }); 21 | 22 | function BookmarksContainer() { 23 | const dispatch = useDispatch(); 24 | const bookmarks = useSelector(state => state.appDataReducer.bookmarks); 25 | const [bookmarksData, setBookmarksData] = useState(bookmarks); 26 | const [showModal, setShowModal] = useState({ 27 | show: false, 28 | data: {} 29 | }); 30 | 31 | const token = localStorage.getItem("token"); 32 | 33 | const config = { 34 | headers: { Authorization: `Bearer ${token}` } 35 | }; 36 | 37 | useEffect(() => { 38 | !bookmarks && 39 | axios.get("/bookmarks", config).then(res => { 40 | setBookmarksData(res.data); 41 | dispatch(storeBookmarksData(res.data)); 42 | }); 43 | }, [bookmarks, dispatch]); 44 | 45 | return ( 46 |
42 |
44 |
115 |
134 | -
121 | {_.orderBy(
122 | transformData(props.classified || []),
123 | ["count"],
124 | ["desc"]
125 | ).map((c, i) => {
126 | return (
127 |
50 |
51 |
52 |
59 | {props.credentials?.usernames.map((entry, index) => (
60 | |
64 | ))}
65 |
66 |
75 | {props.credentials?.emails.map((entry, index) => (
76 | |
80 | ))}
81 |
82 |
84 |
85 |
130 | ) : (
131 | PlaceholderImage()
132 | )}
133 |
86 |
129 | ForensiX
2 |Google Chrome forensic tool
3 | 4 |
5 | 
6 |
Forensic tool for processing, analyzing and visually presenting Google Chrome artifacts.
9 | 10 |  11 | 12 | ## Features 13 | * Mounting of volume with Google Chrome data and preserving integrity trough manipulation process 14 | - read only 15 | - hash checking 16 | * Suspect profile and behavior estimations including: 17 | - personal information (emails, phone nums, date of birth, gender, nation, city, adress...) 18 | - Chrome metadata 19 | - Accounts 20 | - Version 21 | - Target system metadata 22 | - Operating system 23 | - Display resolution 24 | - Mobile Devices 25 | - Browsing history URL category classification using ML model 26 | - Login data frequency (most used emails and credentials) 27 | - Browsing activity during time periods (heatmap, barchart) 28 | - Most visited websites 29 | * Browsing history 30 | - transition types 31 | - visit durations 32 | - avg. visit duration for most common sites 33 | * Login data (including parsed metadata) 34 | * Autofills 35 | - estimated cities and zip codes 36 | - estimated phone number 37 | - other possible addresses 38 | - geolocation API (needed to be registered to Google) 39 | * Downloads (including default download directory, download statistics...) 40 | - default download directory 41 | - download statistics 42 | * Bookmarks 43 | * Favicons (including all subdomains used for respective favicon) 44 | * Cache 45 | - URLs 46 | - content types 47 | - payloads (images or base64) 48 | - additional parsed metadata 49 | * Volume 50 | - volume structure data (visual, JSON) 51 | * Shared database to save potential evidence found by investigators 52 | 53 | 54 | ## Installation 55 | 56 | ### Requirements 57 | 58 | - [Docker](https://docs.docker.com/install/) 59 | - [Docker Compose](https://docs.docker.com/compose/install/) 60 | 61 | ### Quick Start 62 | 63 | 1. **Clone the repository:** 64 | ```bash 65 | git clone https://github.com/ChmaraX/forensix.git 66 | cd forensix 67 | ``` 68 | 69 | 2. **Prepare your browser data:** 70 | Copy your Chrome/Brave browser data to the `data` directory: 71 | ```bash 72 | # For Chrome (replace with your actual profile path) 73 | cp -r "/Users/username/Library/Application Support/Google/Chrome/Default/." ./data/ 74 | 75 | # For Brave (replace with your actual profile path) 76 | cp -r "/Users/username/Library/Application Support/BraveSoftware/Brave-Browser/Profile 2/." ./data/ 77 | ``` 78 | 79 | 3. **Build and start the application:** 80 | ```bash 81 | docker-compose up --build 82 | ``` 83 | 84 | **That's it!** The Docker setup will automatically: 85 | - Build all services from source code 86 | - Install Node.js and Python dependencies 87 | - Download the ML model (~700MB) for URL classification 88 | - Start all services 89 | 90 | **Note:** The first build may take several minutes due to downloading dependencies and the ML model. 91 | 92 | ### Manual Installation (Alternative) 93 | 94 | If you prefer to run without Docker: 95 | 96 | 1. **Install Python dependencies:** 97 | ```bash 98 | pip install -r requirements.txt 99 | ``` 100 | 101 | 2. **Download the ML model:** 102 | ```bash 103 | ./download-model.sh 104 | ``` 105 | 106 | 3. **Install and start services manually:** 107 | ```bash 108 | # Server 109 | cd server 110 | npm install 111 | npm start 112 | 113 | # Client (in another terminal) 114 | cd client 115 | npm install 116 | npm start 117 | ``` 118 | 119 | The runninng services are listenning on: 120 | 121 | - ForensiX UI => http://localhost:3000 122 | - ForensiX Server => http://localhost:3001 123 | - MongoDB => http://localhost:27017 124 | 125 | ## HTTPS/SSL 126 | 127 | If you want to use `HTTPS` for communication between on UI or Server side, place key and certificate into `/certificates` directory in either `/server` or `/client` directory. 128 | 129 | To generate self-signed keys: 130 | 131 | ```bash 132 | openssl req -nodes -new -x509 -keyout server.key -out server.cert 133 | ``` 134 | 135 | Change `baseURL` protocol to https in `/client/src/axios-api.js`, 136 | then rebuild the specific changed image: 137 | 138 | ```bash 139 | docker-compose buildSign In
45 |46 | 71 | 72 | ); 73 | 74 | const signUpSegment = ( 75 | <> 76 |
Sign Up
77 |78 | 117 | 118 | ); 119 | 120 | return ( 121 |
124 |
126 |
132 | Don't have an account yet?
133 |
134 |
137 |
138 | 126 |
127 | ForensiX - Digital Forensics Tool
128 | Browser Artifact Analysis & Investigation
129 | Open Source Forensic Software
130 |
48 | Hosting: {securityModal?.data?.site?.hosting?.[0]} 49 |
50 |51 | IPs:{" "} 52 | {securityModal?.data?.site?.ip?.map((ip) => ( 53 |
{ip}
54 | ))} 55 | 56 |57 | TLS cert. expires: {securityModal?.data?.tls?.cert_expires} 58 |
59 |60 | Servers:{" "} 61 | {securityModal?.data?.software?.server?.map((server) => ( 62 |
63 | {server.name} / {server.version} 64 |
65 | ))} 66 | 67 |Ratings:
{" "} 68 |69 | TLS: {securityModal?.data?.ratings?.tls?.rating} 70 |
71 |72 | Total: {securityModal?.data?.ratings?.total?.rating} 73 |
74 |75 | Domain: {securityModal?.data?.ratings?.domain?.rating} 76 |
77 |78 | Security: {securityModal?.data?.ratings?.security?.rating} 79 |
80 |-
94 | {geo?.cities.map((city) => {
95 | return
-
105 | {geo?.addresses.map((address) => {
106 | return
127 | {rowData.contentType?.includes("image") ? (
128 | 
129 | ) : (
130 |
133 | )}
134 |
135 | );
136 | }}
137 | />
138 |
76 | {profile.fullname}
77 |
107 | );
108 |
109 | const AccountContent = (accounts) =>
110 | accounts.length < 1 ? (
111 |
78 | gender:{" "}
79 | {profile.birthday.gender === 1
80 | ? "male"
81 | : profile.birthday.gender === 2
82 | ? "female"
83 | : "unknown"}{" "}
84 |
96 | nation: {profile.nation.country.substring(0, 15)}{" "}
97 |
98 | birthday: {profile.birthday.birthyear || "unknown"}
99 |
101 | address: {profile.probableAddress || "unknown"}
102 |
103 | city: {profile.probableCity || "unknown"}
104 | phone: {profile.phone || "unknown"}
105 |
No accounts found.
112 | ) : ( 113 |-
114 | {accounts.map((acc, i) => (
115 |
121 | email: {acc.email}
122 | locale: {acc.locale}
123 |
125 | adv. protection:{" "}
126 | {acc.is_under_advanced_protection.toString()}
127 | child account: {acc.is_child_account.toString()}
128 |