Browser history with powershell

Question

I`m trying to create a script that will retrieve all my browser history, the problem is that I cant make it work with the exact link and the date-time that the website was visited.

Can anyone help me here?

I have already tried this page, but still can`t get Date-Time/ complete link information.

Export Chrome History with Powershell

function Get-ChromeHistory {
            $Path = "$Env:systemdrive\Users\$UserName\AppData\Local\Google\Chrome\User Data\Default\History"
            if (-not (Test-Path -Path $Path)) {
                Write-Verbose "[!] Could not find Chrome History for username: $UserName"
            }
            $Regex = '(htt(p|s))://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
            $Value = Get-Content -Path "$Env:systemdrive\Users\$UserName\AppData\Local\Google\Chrome\User Data\Default\History"|Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique
            $Value | ForEach-Object {
                $Key = $_
                if ($Key -match $Search){
                    New-Object -TypeName PSObject -Property @{
                        User = $UserName
                        Browser = 'Chrome'
                        DataType = 'History'
                        Data = $_
                    }
                }
            }        
        }

Actual result: Chrome | myusername | https://www.stackoverflow.com/

Expected result: Chrome | username | 06/21/2019 11:05 | https://stackoverflow.com/questions/ask

user_5904821 · Answer

In addition to the SQLLite Parsing problem, the code above has two bugs: $UserName is not specified and the regex only finds HTTP URLs. Below is a corrected version that gets both HTTP and HTTPS top-level URLs. Unfortunately it does not include the resource path, which you seemed to want but is not possible to get reliably from the SQLLite file. There's no delimiter for the end of a URL in the file.

function Get-ChromeHistory {
    $Path = "$Env:SystemDrive\Users\$Env:USERNAME\AppData\Local\Google\Chrome\User Data\Default\History"
    if (-not (Test-Path -Path $Path)) {
        Write-Verbose "[!] Could not find Chrome History for username: $UserName"
    }
    $Regex = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
    $Value = Get-Content -Path $path | Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique
    $Value | ForEach-Object {
        $Key = $_
        if ($Key -match $Search){
            New-Object -TypeName PSObject -Property @{
                User = $env:UserName
                Browser = 'Chrome'
                DataType = 'History'
                Data = $_
            }
        }
    } 
}

Browser history with powershell

1 Answers