Chrome Values Lookup Tables
I've fielded a few questions recently about what some value buried in a Chrome artifact means. I find myself going to the Hindsight source on GitHub and drilling down into the code because I know I have the values translated there. That seems kind of inefficient, so to make it easier for me (and you!) I'm putting some of the value tables I look up often here on this page.
Downloads
All the following values describe some aspect of how Chrome downloads files: if the download is dangerous, if the download was interrupted, and the state of the download.
Download Danger Type
The 'value' below appears in 'History' SQLite database → 'downloads' table → 'danger_type' column.
| Value | Name | Description |
|---|---|---|
| 0 | Not Dangerous | The download is safe. |
| 1 | Dangerous | A dangerous file to the system (e.g.: a pdf or extension from places other than gallery). |
| 2 | Dangerous URL | SafeBrowsing download service shows this URL leads to malicious file download. |
| 3 | Dangerous Content | SafeBrowsing download service shows this file content as being malicious. |
| 4 | Content May Be Malicious | The content of this download may be malicious (e.g., extension is exe but SafeBrowsing has not finished checking the content). |
| 5 | Uncommon Content | SafeBrowsing download service checked the contents of the download, but didn't have enough data to determine whether it was malicious. |
| 6 | Dangerous But User Validated | The download was evaluated to be one of the other types of danger, but the user told us to go ahead anyway. |
| 7 | Dangerous Host | SafeBrowsing download service checked the contents of the download and didn't have data on this specific file, but the file was served from a host known to serve mostly malicious content. |
| 8 | Potentially Unwanted | Applications and extensions that modify browser and/or computer settings |
| 9 | Whitelisted by Policy | Download URL whitelisted by enterprise policy. |
Source: download_danger_type.h
Download Interrupt Reason
The 'value' below appears in 'History' SQLite database → 'downloads' table → 'interrupt_reason' column. Values under 20 are file-related (except 0); the 20s are network-related; the 30s are server-related; 40s are because of user input; and lastly, 50 is a crash.
| Value | Name | Description |
|---|---|---|
| 0 | No Interrupt | Success |
| 1 | File Error | Generic file operation failure. |
| 2 | Access Denied | The file cannot be accessed due to security restrictions. |
| 3 | Disk Full | There is not enough room on the drive. |
| 5 | Path Too Long | The directory or file name is too long. |
| 6 | File Too Large | The file is too large for the file system to handle. |
| 7 | Virus | The file contains a virus. |
| 10 | Temporary Problem | The file was in use. Too many files are opened at once. We have run out of memory. |
| 11 | Blocked | The file was blocked due to local policy. |
| 12 | Security Check Failed | An attempt to check the safety of the download failed due to unexpected reasons. |
| 13 | Resume Error | An attempt was made to seek past the end of a file in opening a file (as part of resuming a previously interrupted download). |
| 20 | Network Error | Generic network failure. |
| 21 | Operation Timed Out | The network operation timed out. |
| 22 | Connection Lost | The network connection has been lost. |
| 23 | Server Down | The server has gone down. |
| 30 | Server Error | The server indicates that the operation has failed (generic). |
| 31 | Range Request Error | The server does not support range requests. |
| 32 | Server Precondition Error | The download request does not meet the specified precondition. |
| 33 | Unable to get file | The server does not have the requested data. |
| 34 | Server Unauthorized | Server didn't authorize access to resource. |
| 35 | Server Certificate Problem | Server certificate problem. |
| 36 | Server Access Forbidden | Server access forbidden. |
| 37 | Server Unreachable | Unexpected server response. This might indicate that the responding server may not be the intended server. |
| 38 | Content Length Mismatch | The server sent fewer bytes than the content-length header. It may indicate that the connection was closed prematurely, or the Content-Length header was invalid. The download is only interrupted if strong validators are present. Otherwise, it is treated as finished. |
| 39 | Cross Origin Redirect | An unexpected cross-origin redirect happened. |
| 40 | Cancelled | The user cancelled the download. |
| 41 | Browser Shutdown | The user shut down the browser. |
| 50 | Browser Crashed | The browser crashed. |
Source: download_interrupt_reason_values.h
Download State
The 'value' below appears in 'History' SQLite database → 'downloads' table → 'state' column.
| Value | Name | Description |
|---|---|---|
| 0 | In Progress | Download is actively progressing. |
| 1 | Complete | Download is completely finished. |
| 2 | Cancelled | Download has been cancelled. |
| 3 | Interrupted | '3' was the old "Interrupted" code until a fix, then it was '4', but now it looks like '3' is in use again. |
| 4 | Interrupted | This state indicates that the download has been interrupted. |
Source: download_item.h
URL History
These values pertain to URL visits (or just visits for brevity). Both of these sources can add a lot of important context to an investigation: where the visit actually took place, and what (if any) history was cleared.
History Visit Source
Not all visits recorded in Chrome's history happened in that local Chrome browser. This table tracks the source of the visit, which falls into three categories: the visit was synced from another device; the visit was done on the device, but was imported from another web browser or added by an extension, or the visit was in fact done in Chrome, on that device (typically the majority).
The 'value' below appears in 'History' SQLite database → 'visit_source' table → 'source' column.
| Value | Name | Description |
|---|---|---|
| 0 | Synced | Synchronized from somewhere else. |
| 1 | Local | User browsed. In my experience, this value isn't written; it will be null. |
| None | Local | See https://cs.chromium.org/chromium/src/components/history/core/browser/visit_database.cc |
| 2 | Added by Extension | Added by an extension. |
| 3 | Firefox (Imported) | |
| 4 | IE (Imported) | |
| 5 | Safari (Imported) |
History Cleared Time Span
The 'value' below appears inside the 'Preferences' JSON file → 'browser' → 'clear_data' → 'time_period'. The companion key Preferences['browser']['last_clear_browsing_data_time'] has a timestamp that (I believe) can be used in conjunction with the 'time_period', but it is not always present. I talked about how to use this artifact in The Chrome history was cleared! Now what? if you want to learn more.
The values in the above 'Clear browsing data' dialog correspond to the values below (found in the Preferences JSON).
| Value | Description |
|---|---|
| 0 | the past hour |
| 1 | the past day |
| 2 | the past week |
| 3 | the past 4 weeks |
| 4 | the beginning of time |