// artifact family
browser extension forensics
10 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- chrome extension manifest permission forensic analyzerdrop extension manifest + crx unpack · parse permissions + host access + update url · runs locally
- firefox addon xpi artifact forensic extractordrop firefox xpi/add-on export · parse signed state + optional permissions · runs locally
- safari web extension artifact forensic analyzerdrop safari web extension bundle export · parse entitlements + content scripts · runs locally
- edge extension side load artifact forensic analyzerdrop edge extension policy sideload log · parse force-installed ids + sources · runs locally
- browser extension service worker log forensic analyzerdrop mv3 service worker debug log · parse fetch + alarm + message events · runs locally
- password manager extension vault forensic extractordrop lastpass/1password extension local vault export · parse entries + autofill domains · runs locally
- ad blocker extension filter list forensic analyzerdrop ublock/adguard filter subscription export · parse custom rules + blocked domain hits · runs locally
- crypto wallet browser extension artifact forensic extractordrop metamask/phantom extension storage export · parse accounts + chain prefs + dapp connections · runs locally
- browser extension content script injection forensic analyzerdrop extension content script registry export · parse matched urls + all_frames flags · runs locally
- browser extension cross profile correlatordrop 2+ browser extension exports · correlate extension id + permission overlap · runs locally