Chrome history file locations
2026-05-19 · 2 min
Chrome keeps user data per OS user under a vendor directory, with one
sub-folder per profile (Default, Profile 1, Profile 2, …). On a host
where the user creates separate work and personal profiles, treat each
folder as a distinct case scope.
Profile root by OS
Windows
C:\Users\<user>\AppData\Local\Google\Chrome\User Data\<profile>
C:\Users\<user>\AppData\Local\Google\Chrome\User Data\<profile>\Cache
macOS
/Users/<user>/Library/Application Support/Google/Chrome/<profile>
/Users/<user>/Library/Caches/Google/Chrome/<profile>/Cache
Linux
/home/<user>/.config/google-chrome/<profile>
/home/<user>/.cache/google-chrome/<profile>/Cache
What each file holds
| Data | File | Format | Where inside |
|---|---|---|---|
| Website visits | History | SQLite | urls, visits, visit_source |
| Searches | History | SQLite | keyword_search_terms, urls |
| Downloads | History | SQLite | downloads, downloads_url_chains |
| Cookies | Network/Cookies | SQLite | cookies |
| Form history | Web Data | SQLite | autofill, autofill_profiles |
| Logins | Login Data | SQLite | logins |
| Favicons | Favicons | SQLite | favicons, favicon_bitmaps, icon_mapping |
| Top sites | Top Sites | SQLite | top_sites, thumbnails |
| Bookmarks | Bookmarks | JSON | — |
| Preferences | Preferences, Secure Preferences | JSON | — |
| Sessions | Sessions/Session_*, Sessions/Tabs_* | Chrome SNSS | — |
| Cache | Cache/index, Cache/data_#, Cache/f_###### | Custom | — |
| Local Storage | Local Storage/leveldb/ | LevelDB | per-origin keys |
| IndexedDB | IndexedDB/<origin>.indexeddb.leveldb/ | LevelDB | structured values |
In recent Chrome builds (M96+) the Cookies SQLite file lives inside the
Network/ subdirectory of the profile. Older acquisitions may still find
it at the profile root.
Timestamps and WAL
Visit times and most other Chrome timestamps are microseconds since
1601-01-01 UTC (see browser timestamp formats).
The autofill table is an exception and uses Unix seconds.
Chrome opens History in WAL mode. Always grab History-wal and
History-shm along with the main file — without them you can miss the
last few minutes of browsing.
See recovering recent history from WAL.
Acquisition notes
Historyis locked while Chrome is running. Either close the browser, use a Volume Shadow Copy, or use a tool that handles the lock (KAPE pulls the whole profile).- Profiles 2 and beyond often hold the artifacts that matter; do not stop
at
Default. - Correlate downloads with the MFT and LNK files when the executable was later launched by the user.