google-analytics-cookie-parser

A WIP forensics tool for Windows written in Python, for parsing Google Analytics cookies.

• Select the browser and browser version you're using from the dropdown at the top
• Find the cookies file using the instructions for your browser
• Click 'Process'

• You can view information for a given domain by selecting that domain with the Domain dropdown after loading a cookie file
• You can also export all Google Analytics cookies in a parsed format to .csv files in a chosen directory by clicking the 'Output to .csv' button

• Every command requires both an input file path (-i or --input) and a browser name (-b or --browser) to be specified. Currently, -b/--browser can only be firefox.3+ or csv

• The info command, which does not require any additional parameters, will show the number of GA cookies found and the number of unique domains for which any cookies were found

• The list-domains command, which does not require any additional parameters, will list all domains for which GA cookies were found

• The domain-info command, which requires the additional parameter -d or --domain, will list a parsed version of all available information for the given domain. The domain should be given in the format in which it is found with list-domains

• The export-csv command, which requires the additional parameter -o or --output which should be a directory path of the output directory, will export all found cookie data to .csv files in the given directory. The -f or --force-overwrite option can be given to automatically overwrite files if they exist without prompting the user.

• Reading and parsing cookies.sqlite from Firefox v3+ and any browser from which you can retrieve cookies as a .csv file
• Analysing and parsing all relevant Google Analytics cookies (_ga, __utma, __utmb, __utmz)
• Presenting all available information for a given domain
• Exporting GA cookie information to a .csv file

I would like to thank Kevin Ripa, for being such an excellent instructor and mentor, and providing the inspiration to create this tool.