Someone logged in as a user and removed all of the Google Chrome user's apps, extensions, bookmarks, history, and settings. After which, they closed the browser window and restarted it (overwriting the hidden backup file Chrome makes). These changes have already propagated out to the other machines via Google Sync.
How can I recover this data? Ideally, with as much forensic information as possible (date/times deleted, accessed, etc). I need to recover this data ASAP.
I'm digging around on Google now, but I haven't had made any real headway yet. I'll update this thread with any info I find / attempt.
Best Answer
By following the instructions from http://shaneamurray.blogspot.com/2011/06/restore-lost-extensions-in-google.html, I was able to recover all of the apps, extensions, bookmarks, et al.
Essentially, from a Windows 7 PC, you can go to the following path:
C:\Users{username}\AppData\Local\Google\Chrome\and right-click on the "User Data" folder. From there, go to Properties, and then the "Previous Versions Tab" and you will be able to restore to an earlier version when the extensions / settings were available.NOTE: Make sure that the Google Chrome process is not running (including in the System Tray) when restoring the files or you will receive an error (in which case, simply kill the process and hit the 'Try Again' button on the error prompt).
This will restore everything, it appears, other than the Google Gadgets. Unfortunately, I still have to dig through the Linux box where the settings were originally altered and attempt to find some information to determine the date/time the incident occurred. So, the forensic aspect is still a work in progress, but at least the user data has been restored and they learned an incredibly important lesson... Don't leave your PC unlocked.