{"id":51595158,"url":"https://github.com/securityronin/leveldb-forensic","last_synced_at":"2026-07-11T18:01:36.837Z","repository":{"id":370791614,"uuid":"1296755667","full_name":"SecurityRonin/leveldb-forensic","owner":"SecurityRonin","description":"Read-only forensic LevelDB reader + Chrome Local/Session Storage decoder (recovers deleted records)","archived":false,"fork":false,"pushed_at":"2026-07-11T00:54:16.000Z","size":82,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-11T02:12:36.693Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-10T17:40:06.000Z","updated_at":"2026-07-11T00:54:20.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/leveldb-forensic","commit_stats":null,"previous_names":["securityronin/leveldb-forensic"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/leveldb-forensic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fleveldb-forensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fleveldb-forensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fleveldb-forensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fleveldb-forensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/leveldb-forensic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fleveldb-forensic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35370428,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-11T18:01:35.212Z","updated_at":"2026-07-11T18:01:36.822Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"[![Docs](https://img.shields.io/badge/docs-securityronin.github.io-blue.svg)](https://securityronin.github.io/leveldb-forensic/)\n[![CI](https://github.com/SecurityRonin/leveldb-forensic/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/leveldb-forensic/actions/workflows/ci.yml)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)\n[![Sponsor](https://img.shields.io/badge/sponsor-h4x0r-ea4aaa?logo=github-sponsors)](https://github.com/sponsors/h4x0r)\n[![unsafe forbidden](https://img.shields.io/badge/unsafe-forbidden-success.svg)](#trust-but-verify)\n[![security: cargo-deny](https://img.shields.io/badge/security-cargo--deny-success.svg)](deny.toml)\n\n# leveldb-forensic\n\n**The deleted keys are the evidence — and a normal LevelDB `Get()` can't see them.** `leveldb4n6` enumerates *every* raw record in a LevelDB directory — Chrome history, extension state, Local/Session Storage — including the **tombstones and superseded versions** the merged database view hides, each carrying its **sequence number** and origin file. It opens the evidence read-only, never takes the `LOCK`, and never writes to the directory.\n\n```bash\ncargo install --path leveldb4n6\nleveldb4n6 dump \"Local Storage/leveldb\"        # every record, tombstones included\n```\n\n**[Full documentation →](https://securityronin.github.io/leveldb-forensic/)**\n\n---\n\n## See it in 30 seconds\n\n```console\n$ leveldb4n6 dump \"Local Storage/leveldb\" -f text\norigin=https://mail.example.com  key=theme     value=dark          seq=41  deleted=false\norigin=https://mail.example.com  key=session   value=\u003cUTF-16\u003e...    seq=39  deleted=false\norigin=https://mail.example.com  key=draft      value=              seq=44  deleted=TRUE\n```\n\nThe `deleted=TRUE` row is a **tombstone**: a key the browser deleted, recovered from the WAL with the sequence number that orders it against the live writes. A normal LevelDB reader merges these away; a forensic reader surfaces them.\n\nPoint it at a raw LevelDB directory instead and you get the raw key/value records; point it at `Session Storage/` and it decodes the namespace/map structure. Choose `-f jsonl` or `-f csv` for a pipe-friendly, round-trippable stream.\n\n---\n\n## Why not just use a LevelDB library?\n\nA normal LevelDB binding gives you the **merged view**: the current value of each live key, with deletions and old versions already discarded — exactly the forensic payload thrown away. `leveldb-core` instead walks the raw file structures directly:\n\n| Layer | What it reads | What it surfaces |\n|---|---|---|\n| `.ldb` SSTable | Footer → index block → data blocks (prefix-compressed, optional Snappy, crc32c-checked) | every internal key with its `seq` and value-type (value / **deletion**) |\n| `.log` WAL | 32 KiB blocks → physical-record fragments → reassembled `WriteBatch` | every `Put`/`Delete` op with its `seq` |\n\nBoth are read without opening the database, so an active browser's `LOCK` is never contended and the evidence directory is never mutated.\n\n## Three crates\n\n- **`leveldb-core`** — the pure-Rust, `#![forbid(unsafe_code)]`, panic-free raw reader. `read_dir(path) -\u003e Vec\u003cRecord\u003e`.\n- **`leveldb-forensic`** — Chrome/Chromium Local Storage and Session Storage decoding on top of `leveldb-core` records.\n- **`leveldb4n6`** — the read-only CLI.\n\n## Trust, but verify\n\n`leveldb-core` is validated against an **independent oracle**: the pure-Rust [`rusty-leveldb`](https://crates.io/crates/rusty-leveldb) reimplementation writes real `.ldb`/`.log` files with known overwrites and deletes; our reader then reads them back and confirms (a) live records match what `rusty-leveldb` wrote and (b) the superseded and deleted records — which `rusty-leveldb`'s merged view hides — *also* surface. See [`docs/validation.md`](https://securityronin.github.io/leveldb-forensic/validation/).\n\nEvery parser is panic-free by lint (`clippy::unwrap_used`/`expect_used = deny`), all lengths/offsets are bounds-checked before use, and each on-disk structure (footer, data block, log record) has a `cargo-fuzz` target asserting \"must not panic\" on arbitrary input.\n\n---\n\n[Privacy Policy](https://securityronin.github.io/leveldb-forensic/privacy/) · [Terms of Service](https://securityronin.github.io/leveldb-forensic/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fleveldb-forensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Fleveldb-forensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fleveldb-forensic/lists"}