drop chrome login data sqlite csv or mft csv · detect cleared browser saved passwords · identify evidence of credential store access or wiping · surface password store access by unauthorized processes · runs locally
chrome login data · firefox logins.json · login data mft access · chromepass / browserpassworddecryptor correlation
drop chrome login data sqlite csv · firefox logins.json · mft or usn csv · prefetch/shimcache