5

Someone logged in as a user and removed all of the Google Chrome user's apps, extensions, bookmarks, history, and settings. After which, they closed the browser window and restarted it (overwriting the hidden backup file Chrome makes). These changes have already propagated out to the other machines via Google Sync.

How can I recover this data? Ideally, with as much forensic information as possible (date/times deleted, accessed, etc). I need to recover this data ASAP.

I'm digging around on Google now, but I haven't had made any real headway yet. I'll update this thread with any info I find / attempt.

Improve this question
1
  • I went ahead and posted your answer as a Community Wiki answer. This way people can easily see the answer to your question.
    – Mike Koch
    May 5, 2014 at 23:02

1 Answer 1

Reset to default
4

By following the instructions from http://shaneamurray.blogspot.com/2011/06/restore-lost-extensions-in-google.html, I was able to recover all of the apps, extensions, bookmarks, et al.

Essentially, from a Windows 7 PC, you can go to the following path:

C:\Users{username}\AppData\Local\Google\Chrome\ and right-click on the "User Data" folder. From there, go to Properties, and then the "Previous Versions Tab" and you will be able to restore to an earlier version when the extensions / settings were available.

NOTE: Make sure that the Google Chrome process is not running (including in the System Tray) when restoring the files or you will receive an error (in which case, simply kill the process and hit the 'Try Again' button on the error prompt).

This will restore everything, it appears, other than the Google Gadgets. Unfortunately, I still have to dig through the Linux box where the settings were originally altered and attempt to find some information to determine the date/time the incident occurred. So, the forensic aspect is still a work in progress, but at least the user data has been restored and they learned an incredibly important lesson... Don't leave your PC unlocked.

Improve this answer
2
  • This only works if previous versions are enabled lots of people disable it, there is lots of information missing, from the linked website
    – Ramhound
    Jan 14, 2015 at 2:46
  • @Ramhound this answer is a community wiki, so feel free to add information that you think is missing to improve this answer.
    – Mike Koch
    Jan 14, 2015 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .