±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 35989
New Yesterday: 3 Visitors: 143

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

IEF Web History Issue - Feedback Wanted

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 
  

dd1234
Newbie
 

Re: IEF Web History Issue - Feedback Wanted

Post Posted: Jul 25, 14 15:50

Chris_Ed
Also, if it does this with IE10+, it is an even bigger problem - as I'm not sure I have any other tool which parses webcache.
Chris_Ed

For IE11 history you can open the WebcacheV01.dat file (WebcacheV24.dat for IE10?) with ESEDatabaseView which is free from nirsoft:

www.nirsoft.net/utils/..._view.html

Strart at the table called Continer_14 for visits & work your way outwards. I got that hint from IEF - so it's not all bad news Very Happy

There also a few words on other IE10-11 artefacts here:

computerforensics.cham...gs/windows

Sorry, can't be more help as I'm just starting to work my way through this too & obviously needs some testing.

I've got Chrome, Firefox & IE11 all being used at the same time. I can guarantee that IEF's implelemtnation for Firefox suffers from the same flaw as it does for Chrome. I can't say anything about how it handles IE11 yet.  
 
  

pcstopper18
Senior Member
 

Re: IEF Web History Issue - Feedback Wanted

Post Posted: Jul 25, 14 18:36

Ditto on the use of ESEDatabaseView from Nirsoft.

It is always good practice to be able to use multiple tools or individual artifact parsers to parse information when something doesn't look right or to just confirm what one is seeing.
_________________
Preston Coleman, MFS, GCFE, EnCE

"The only thing necessary for the triumph of evil is for good men to do nothing" - Edmund Burke 
 
  

MagnetForensics
Member
 

Re: IEF Web History Issue - Feedback Wanted

Post Posted: Jul 25, 14 20:53

Hi everyone,

Thanks for bringing this to our/my attention. While our approach has been to consolidate the web history for better/easier viewing, I completely see your points on the importance of seeing every individual visit, especially for the purposes of timelining user activity.

I do agree with Harlan that some may want to see the current view we provide while some may want to see more granularity, so what we plan to do is keep the current Chrome/Firefox Web History artifact as is, but add another for each browser called Chrome Web Visits, or Firefox Web Visits, that provide detail on every visit. I believe this provides the best of both worlds.

We’ll get this update out ASAP, certainly in the next few weeks. If you need more specifics please contact me offline.

This situation does not apply to IE/IE10-11 since they use a different database schema/storage mechanism.

Best regards,
Jad  
 
  

dan0841
Senior Member
 

Re: IEF Web History Issue - Feedback Wanted

Post Posted: Jul 28, 14 12:11

Jad

Thats great!!!

Thanks


Dan  
 

Page 2 of 2
Page Previous  1, 2