Chromium Session File (SNSS)
| Format | Chromium Session File (SNSS) |
|---|---|
| Short name | SNSS |
| Category | log |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Session restore files of Chrome, Edge and other Chromium browsers in the profile's Sessions folder (Session_<time>, Tabs_<time>, Apps_<time>; older versions used 'Current Session' / 'Last Session' and 'Current Tabs' / 'Last Tabs'). A header with the signature and a version is followed by a sequence of commands describing windows, tabs and their navigation entries with URL, title, referrer and timestamp. They show open tabs and per-tab back/forward history, including recently closed tabs, independent of the browsing history database. Format version 5 files are encrypted with the operating system's credential protection and are kept in a separate Sessions_Encrypted folder.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 53 4E 53 53 | SNSS | Signature 'SNSS' (0x53534E53) |
Known extensions
None recorded
References
- command_storage_backend.cc (Chromium source) https://github.com/chromium/chromium/blob/main/components/sessions/core/command_storage_backend.cc
- session_constants.cc (Chromium source) https://github.com/chromium/chromium/blob/main/components/sessions/core/session_constants.cc
Cite this entry
Crush Format Reference, “Chromium Session File (SNSS)”. https://kalink0.github.io/crush-forensics/formats/snss/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction