yeah, that's the one ;)
I'm trying to find the code now... it's eluded me so far.  It was based on a tool, the name of which is also escaping me, but it skims the disk & mem when possible to look for interesting strings.  It's not so much for incident forensics as it is for intelligence gathering, but it's interesting nonetheless.
It's equivalent to doing dd | strings | grep on entire partitions.  Matter of fact, the post module did exactly that, but tried to be as smart as possible about it.  The actual tool I mentioned doesn't do that, it's a native app instead.

-Josh (ks)

On Nov 27, 2013, at 11:34 AM, Joshua Harper PI GCFE GCFA GSEC <notifications@github.com> wrote:

> In modules/post/windows/gather/forensics/gather_browser_history.rb:
> 
> > +class Metasploit3 < Msf::Post
> > +
> > +  include Msf::Post::File
> > +  include Msf::Post::Windows::UserProfiles
> > +  include Msf::Post::Windows::Registry
> > +
> > +  def initialize(info={})
> > +    super( update_info( info,
> > +        'Name' => 'Windows Gather Skype, Firefox, and Chrome Artifacts',
> > +        'Description' => %q{'Gathers Skype chat logs, Firefox history, and Chrome history data from the victim machine.'},
> > +        'License' => MSF_LICENSE,
> > +        'Author' => [ 'Joshua Harper (@JonValt) <josh at radixtx dot com>'],
> > +        'Platform' => %w{ win },
> > +        'SessionTypes' => [ 'meterpreter' ]
> > +      ))
> > +    register_advanced_options([], self.class)
> Ah, kernelsmith. In my email client, it came from "notifications @ github" and was signed "josh." Makes sense now. :-P
> 
> —
> Reply to this email directly or view it on GitHub.
>