It would be good to have a module which can sniff HTTP/S connections for HTTP/S POST parameters and their contents. More and more often Browsers change their behaviors in terms of storing passwords and hence browser passwords via Forensics Tools dont often work. Another scenario which becomes more and more popular is the use of 3rd party passwords storages instead of the internal browser storage e.g. like LastPass or XMarks. So neither of the embedded techniques would grab the password for popular services like GMail, Facebook, etc. and render those functionality useless.

Lastpass: https://lastpass.com/
XMarks: https://www.xmarks.com/