Several people have already done a fantastic job of breaking down the file format and writing scripts to parse these cookies. If Perl is your flavor, check out these handy tools from Jake Cunningham. If you love Python, the script from Satishb3 does a great job of parsing the information.
While both of the above scripts do a fantastic job of parsing and presenting the information for the Cookies.binarycookies file, I wanted a way to parse a directory full of these binarycookies as well as the Google Analytic values from the cookies.
The awesome thing about open source is the ability to not only learn by looking at someone else's code, but to build on top of what they have done and create or tailor something for what you need (then hopefully turn around and share it again with others).
When I was reviewing the Satishb3 python script, I did not see a specific licensing agreement distributed with the code. I reached out to Satishb3 for permission to reuse his code and luckily for me, he graciously wrote back granting me permission.
This saved me a lot of time, and enabled me to focus my efforts on adding in the features that I needed. I sat down with some Dr. Pepper and the handy, dandy SIFT Workstation,and wrote a python script that parses the binarycookies file with the following additions:
1) Parses a directory full of cookies
2) Parses the Google Analytic values from the Cookies (umta, utmb, utmz)
3) Added an option to output into TLN format
To process one file:
bc_parser.py -f Cookies.binarycookies -o myoutput.tsv
To process a directory of cookies:
bc_parser -d /full/path/to/cookies -o myoutput.tsvTo have the output in TLN format (this can be used with the file or directory option):
bc_parser.py -f Cookies.binarycookies -o myoutput.tsv - t -H MariPC -u Mari-f is the binary cookie filename, -o is the output file, -t means TLN output, -H is the Host (optional) and -u is the username (optional) .
Example Cookie Output:
Google Analytic Output, utmz:
TLN (Timeline Output):
Download the bc_parser python script.