±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36087
New Yesterday: 2 Visitors: 159

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Firefox 3 Deleted History Analysis

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

dan0841
Senior Member
 

Firefox 3 Deleted History Analysis

Post Posted: Mar 22, 11 13:25

I was wondering what tools / methods people are using for analysis of deleted Firefox 3 history records?

NetAnalysis now does the cache records but does not do the deleted SQLITE history records from unallocated etc. There are also many tools for analysing the live sqlite databases but there do not appear to be any commercial tools which locate deleted history.  
 
  

Belkasoft
Senior Member
 

Re: Firefox 3 Deleted History Analysis

Post Posted: Mar 22, 11 13:43

- dan0841
I was wondering what tools / methods people are using for analysis of deleted Firefox 3 history records?

NetAnalysis now does the cache records but does not do the deleted SQLITE history records from unallocated etc. There are also many tools for analysing the live sqlite databases but there do not appear to be any commercial tools which locate deleted history.


Please try our Belkasoft Evidence Center. Write me PM if there are any questions about the product.  
 
  

diesel
Member
 

Re: Firefox 3 Deleted History Analysis

Post Posted: Mar 22, 11 14:07

I was reading up on internet browser this morning for something I am working on and came across this, that may be of interested to you.

forensicsfromthesausag...s-you.html  
 
  

minime2k9
Senior Member
 

Re: Firefox 3 Deleted History Analysis

Post Posted: Mar 24, 11 13:11

- diesel
I was reading up on internet browser this morning for something I am working on and came across this, that may be of interested to you.

forensicsfromthesausag...s-you.html


None of the tools described in that article appear to deal with the deleted SQLite records, mainly live files and deleted cached records only.

Same appears to apply to the belkasoft program mentioned earlier.  
 
  

mars4
Newbie
 

Re: Firefox 3 Deleted History Analysis

Post Posted: Mar 24, 11 16:07

The paper "Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records" ( www.sciencedirect.com/...archtype=a ) can be helpfull.
The author cites these tools:
FoxAnalysis (http://www.forensic-software.co.uk)
Firefox Forensics (http://www.machor-software.com)
Firefox 3 Extractor (http://www.firefoxforensics.com)
And he wrote this other tool:
Firefox 3 History Recovery (http://ff3hr.sourceforge.net/)  
 
  

minime2k9
Senior Member
 

Re: Firefox 3 Deleted History Analysis

Post Posted: Mar 24, 11 16:46

Id take it though that people are generally just dealing with the live profiles as opposed to the deleted records?

Mars4 - 3 of those programs deal exclusively with live files and the ff3hr only works for firefox 3.0 as the record structure changed as at 3.5+ and it crashes out on most machines.  
 
  

douglasbrush
Senior Member
 

Re: Firefox 3 Deleted History Analysis

Post Posted: Mar 24, 11 19:23

- minime2k9
Mars4 - 3 of those programs deal exclusively with live files and the ff3hr only works for firefox 3.0 as the record structure changed as at 3.5+ and it crashes out on most machines.


Could you not play with the code:
cdnetworks-us-2.dl.sou...3hr1.2.cpp

And edit to work with the newer structure?  
 

Page 1 of 2
Page 1, 2  Next