When doing forensics sometimes it is very important to retrieve the exact version of the web page visited to see the contents at the time of visit.
Recently I had a similar task but I couldn’t find any tool for Mac OS, so I decided to ask on Twitter, however most of the answers I got were focused on Windows.
After some trail and error with Python open source tools and other paid software I found the perfect solution.
If you want to do the same you can simply copy the cached files from Mac OS and use a freeware tool from nirsoft called: ChromeCacheView
The cached files on Mac should be on ~/Library/Google/Chrome/Cache; and also concider other none primal location such:
~/Library/Application Support/Google/Chrome and
~/Library/Application Support/Google/Chrome/Default/Application Cache
Leave a reply