How to Forensically Examine a Chromebook: Detailed Technical Explanation and Forensic Artefacts

Introduction

Chromebooks differ significantly from traditional Windows or macOS computers. Running Google’s ChromeOS, these devices are heavily cloud-oriented, employ verified boot security, and frequently store evidence within user profiles synchronised with Google accounts.

From a digital forensic perspective, Chromebook examinations present several challenges:

• Extensive cloud storage reliance.
• Strong encryption mechanisms.
• Limited local storage.
• Automatic synchronisation.
• Sandboxed applications.
• Frequent operating system updates.
• Verified boot security protections.

Despite these challenges, Chromebooks contain numerous valuable forensic artefacts that can assist investigators.

Chromebook Architecture

ChromeOS is based on the Linux kernel and uses:

• Read-only system partitions.
• User data partitions.
• Sandboxed applications.
• Verified Boot security.
• TPM-based cryptographic protection.
• Google account synchronisation.

Typical partition structure:

Partition Purpose

ROOT-A Operating system

ROOT-B Backup OS partition

STATE User data

EFI Boot components

OEM Manufacturer data

The STATE partition is the primary forensic interest.

Chromebook Security Features

Verified Boot

Verified Boot checks the integrity of the operating system during startup.

The process validates:

1. Firmware.
2. Bootloader.
3. Kernel.
4. Root filesystem.

Tampering may cause:

• Recovery mode activation.
• Security warnings.
• System restoration.

This can impact forensic examinations if a device is powered on.

TPM Security

Many Chromebooks contain a Trusted Platform Module.

The TPM:

• Stores encryption keys.
• Supports verified boot.
• Protects user credentials.
• Assists full-disk encryption.

Without access to user credentials or live acquisition opportunities, encrypted data may be inaccessible.

Initial Forensic Considerations

Investigators should document:

• Device make and model.
• Serial number.
• Asset tags.
• Power state.
• User logged in.
• Network connectivity.
• Peripheral devices.

Photographs should record:

• Screen contents.
• Open applications.
• Browser tabs.
• Notifications.
• User accounts.

Live Versus Dead Acquisition

Live Acquisition

Advantages:

• Access decrypted user data.
• Obtain active sessions.
• Capture volatile memory.
• Acquire logged-in accounts.

Risks:

• Remote wiping.
• Synchronisation changes.
• Automatic updates.
• Evidence modification.

Dead Acquisition

Advantages:

• Minimal alteration.
• Controlled imaging.
• Reduced contamination.

Disadvantages:

• Encryption barriers.
• Loss of volatile evidence.
• Inaccessible user profiles.

Forensic Acquisition Methods

Physical Acquisition

Depending on the model:

• Removal of eMMC storage.
• Chip-off examination.
• JTAG acquisition.
• ISP acquisition.

Common storage:

• eMMC.
• NVMe SSD.
• UFS storage.

Tools may include:

• Write blockers.
• Hardware imagers.
• Specialist mobile forensic equipment.

Logical Acquisition

Logical extraction may obtain:

• User files.
• Downloads.
• Browser artefacts.
• Application data.

Methods include:

• Developer Mode.
• Linux shell access.
• Administrative APIs.
• Cloud acquisition.

Developer Mode Artefacts

Developer Mode disables some security controls.

Indicators include:

• Boot warnings.
• Modified partitions.
• Shell access logs.
• Configuration changes.

Potential artefacts:

/var/log/

/home/chronos/

/mnt/stateful_partition/

User Profile Artefacts

User data is typically stored within:

/home/chronos/u-<hash>/

or:

/home/chronos/user/

Artefacts include:

• Downloads.
• Browser history.
• Cookies.
• Bookmarks.
• Session information.
• Preferences.

Browser Artefacts

Chrome browser evidence is often the most valuable source.

Important files:

File Evidence

History Browsing activity

Cookies Authentication sessions

Login Data Saved credentials

Bookmarks User interests

Top Sites Frequently visited sites

Preferences Browser settings

Favicons Website evidence

Typical locations:

~/.config/google-chrome/

or

/home/chronos/

History Database

SQLite database:

History

Contains:

• URLs.
• Visit timestamps.
• Download activity.
• Search terms.
• Transition types.

Cookies Database

Cookies

Provides:

• Authentication tokens.
• Website sessions.
• Tracking identifiers.

Login Data

Login Data

May contain:

• Stored usernames.
• Password metadata.
• Credential information.

Passwords may be encrypted.

Downloads Artefacts

Downloads are commonly located within:

/home/chronos/user/Downloads/

Evidence includes:

• Downloaded files.
• Browser download history.
• File timestamps.
• User-created documents.

Google Account Artefacts

The associated Google account may reveal:

• Synchronised bookmarks.
• Search history.
• Browser tabs.
• Cloud files.
• Device information.

Potential evidence:

• Account identifiers.
• Email addresses.
• Authentication tokens.

Google Drive Evidence

Files may exist:

• Locally cached.
• Cloud-only.
• Recently accessed.

Cache locations may contain:

GCache

Artefacts:

• File IDs.
• Synchronisation times.
• Offline copies.
• Access timestamps.

Android Application Artefacts

Modern Chromebooks support Android applications through ARC.

Potential locations:

/run/arc/

and:

/data/data/

Artefacts include:

• Application databases.
• Messages.
• Cache files.
• User settings.

Linux Environment Artefacts

Many devices support Linux containers.

Crostini containers may contain:

• Shell history.
• Source code.
• Documents.
• SSH keys.
• Application logs.

Potential locations:

/mnt/stateful_partition/

/home/root/

System Logs

ChromeOS maintains numerous logs.

Examples:

/var/log/messages

/var/log/ui/

/var/log/update_engine.log

These may reveal:

• User logins.
• Updates.
• Device activity.
• Errors.
• Network connections.

Wi-Fi Artefacts

Wireless evidence may include:

• SSIDs.
• Connection timestamps.
• Security protocols.
• Known networks.

Possible locations:

/home/root/

/var/

USB Device Artefacts

Evidence of removable media may include:

• Mount events.
• Device identifiers.
• Access timestamps.

Potential logs:

/media/removable/

Time and Timestamp Artefacts

ChromeOS uses:

• Unix timestamps.
• WebKit timestamps.
• SQLite timestamps.

Investigators must account for:

• UTC storage.
• Time zone offsets.
• Daylight saving changes.

Cloud Forensics Considerations

Because Chromebooks are cloud-centric, evidence frequently exists outside the device.

Potential sources include:

• Google account records.
• Google Drive.
• Gmail.
• Search history.
• YouTube history.
• Location history.

Cloud acquisition may require:

• User consent.
• Search warrants.
• Production orders.
• Legal authority.

Memory Forensics

If a device is live:

• RAM acquisition may recover:
  • Encryption keys.
  • Browser sessions.
  • Tokens.
  • Chat content.
  • Unsaved documents.

Volatile evidence is lost once powered down.

Timeline Analysis

Investigators can correlate:

• Browser activity.
• Downloads.
• Logins.
• File access.
• USB events.
• Wi-Fi connections.
• Application use.

Timeline analysis helps establish:

• User attribution.
• Activity periods.
• Event sequences.

Common Forensic Tools

Tools used during Chromebook examinations include:

• Cellebrite.
• Magnet AXIOM.
• Autopsy.
• FTK.
• EnCase.
• X-Ways Forensics.
• Volatility.
• SQLite viewers.

Some tools provide limited ChromeOS support, requiring manual analysis of artefacts.

Challenges in Chromebook Forensics

Major challenges include:

• Full-disk encryption.
• Cloud dependency.
• Automatic synchronisation.
• Secure boot.
• Limited local storage.
• Remote wiping.
• Multiple user accounts.
• Frequent updates.

Best Practice Examination Process

1. Photograph the device.
2. Document the power state.
3. Assess encryption risks.
4. Isolate from networks if appropriate.
5. Acquire volatile evidence when possible.
6. Create a forensic image.
7. Verify image hashes.
8. Examine user profiles.
9. Analyse browser artefacts.
10. Correlate local and cloud evidence.
11. Produce timelines.
12. Report findings.

Conclusion

Chromebook forensic examinations differ substantially from traditional computer examinations due to ChromeOS architecture, verified boot, encryption, and extensive cloud integration.

Although local evidence may be limited, valuable artefacts exist within browser databases, user profiles, application data, logs, and synchronised cloud services.

Successful examinations often require a combination of:

• Local forensic acquisition.
• Browser artefact analysis.
• Cloud investigation.
• Timeline reconstruction.
• Correlation of user activity across multiple evidence sources.

Understanding ChromeOS architecture and the locations of forensic artefacts is essential for producing reliable and defensible digital forensic findings.

About Athena Forensics

For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.

Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.

We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.

Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.

Our team are all security cleared and we offer non-disclosure agreements if required.

Our premises along with our security procedures have been inspected and approved by law enforcement agencies.

Athena Forensics do not disclose personal information to other companies or suppliers.

Mobile Phone Forensic Expert Witness Services

Digital Forensic Expert Witness Services

Criminal Law

Child Care Proceedings

Our Digital Forensic Experts