Finding the time stamp for an autofill entry in Google Chrome

Question

My pc was stolen and I had Chrome with sync active on it.

Now I'm login into Chrome from a new pc and I'm seeing an autofill entry with a name and address I don't recognize, my theory is that it must be an autofill used by someone who has the computer now (the robber or a 2nd hand buyer)

I can use SQlite browser but I have no idea where to look for the synced autofill records so I can check the create date. Any ideas?

Answer 1

Download SQLite Database Browser. Head over to %localappdata%\Google\Chrome\User Data\Default and copy Web Data file to a separate folder.

Now open Web Data with the SQL Lite browser. Click on Execute SQL and type

SELECT *
FROM   autofill
WHERE  VALUE LIKE 'your-autofill-entry' 

Make a note of the pair id, and type in

SELECT *
FROM   autofill_dates
WHERE  pair_id = number-obtained-from-above-step

That'll get you the Unix epoch of when the autofill entry was created

Head over to Epoch converter and you'll get the Epoch converted to the date/time you're familiar with.