https://github.com/berdav/snappy-fox
🦀🦊 Snappy (Firefox morgue cache format) files de-compressor, works even if they're corrupted
https://github.com/berdav/snappy-fox
cache firefox forensics whatsapp-web
Last synced: about 1 year ago
JSON representation
🦀🦊 Snappy (Firefox morgue cache format) files de-compressor, works even if they're corrupted
- Host: GitHub
- URL: https://github.com/berdav/snappy-fox
- Owner: berdav
- License: gpl-3.0
- Created: 2021-01-24T11:29:34.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2025-01-30T11:48:40.000Z (over 1 year ago)
- Last Synced: 2025-03-21T13:44:34.297Z (over 1 year ago)
- Topics: cache, firefox, forensics, whatsapp-web
- Language: C
- Homepage:
- Size: 230 KB
- Stars: 20
- Watchers: 2
- Forks: 4
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Snappy-fox 🦀🦊
Snappy-fox is a Snappy file decompressor (i.e. morgue cache of Firefox)
which does not have dependencies. It can also reconstruct corrupted
files.
## Why?
Online applications such as whatsapp web (web.whatsapp.com) save cache
files (e.g. images) in a compressed way.
You can recognize these files searching for the pattern sNaPpY:
```bash
grep 'sNaPpY' ~/.mozilla/firefox/*/storage/default/*/cache/morgue/*/*
```
This application can help the retrieval of such cache files.
## Setup
Just compile this application, you will need a C compiler
(gcc or clang) and make
```bash
sudo apt install make gcc
```
Then just compile the application
```bash
make
```
You can add debug prints with
```bash
make CFLAGS=-DDEBUG
```
## How?
The usage of the application is pretty simple:
```bash
./snappy-fox
```
The input or the output files can be `-` to use, respectively, stdin and
stdout.
For instance you can do:
```bash
mkdir /tmp/extracted-cache-whatsapp
for f in
find ~/.mozilla/firefox/**/storage/default/https+++web.whatsapp.com/cache/ -name '*.final';
do
./snappy-fox "$f" "/tmp/extracted-cache-whatsapp/$(basename $f)"
done
```
it will extract all your cache files in the
`/tmp/extracted-cache-whatsapp` directory.
## Example
You can try the application with the example image present in the
example directory:
```bash
./snappy-fox example/exampleimage.snappy example/exampleimage.jpg
```
`alteredimage.snappy` is a corrupted version of the image, you can see
the retrival performance of the tool using:
```bash
./snappy-fox --ignore_offset_errors example/alteredimage.snappy example/alteredimage.jpg
```
