galleta

Galleta is designed specifically for forensic examination of cookie files generated by Microsoft Internet Explorer (MSIE). It processes these files to extract structured data, making it useful for digital investigations where browser activity evidence is needed.

Use cases include incident response, malware analysis involving browser artifacts, and general forensic triage of Windows systems with IE usage. The output format allows easy import into tools like spreadsheets for further review and reporting.

The tool is lightweight, with an installed size of 31 KB, and depends only on libc6, ensuring minimal overhead in forensic toolkits like Kali Linux.

Galleta reads MSIE cookie files, parses their proprietary format, and extracts fields such as cookie name, value, domain, path, expiration, and other attributes. It outputs the parsed data using a user-specified field delimiter (TAB by default), enabling structured analysis. The tool handles file opening and validation, reporting errors if the cookie file cannot be accessed.