Axiom - question re...
 
Notifications
Clear all

Axiom - question regarding artifact type: ' Edge/Internet Explorer 10-11 Main History'

4 Posts
3 Users
0 Likes
858 Views
ITomRyanI
(@itomryani)
Posts: 2
New Member
Topic starter
 

Hello all,

I've noticed when examining a HDD image and checking under the artifact type 'Edge/Internet Explorer 10-11 Main History', a users history is shown of the interactions of URL's they have accessed. (e.g. URL: http://www.msn.com/en-gb/ @ 17/06/2022 13:04:29).

However, I've noticed some of the artifacts being recorded are file path locations on the local system (e.g. file:///C:Users/*username*/Desktop/*file name*) or another driver letter location (e.g. file:///U:/*folder path*/*file name*).

What I want to understand is every scenario these artifacts are being created for on Edge and IE? Is it when a file is uploaded to one of these browsers and the file path is where the file was located? or is it when the file through the browser and the location stated is where the file was saved to?

 

Thank you in advance for your help!

Tom

 

 
Posted : 17/06/2022 1:46 pm
Topic Tags
minime2k9
(@minime2k9)
Posts: 473
Reputable Member
 

I'm not sure about every scenario, however this usually happens when a user accesses a file using File Explorer. It's just stored in the Edge/IE files.

 
Posted : 18/06/2022 10:52 am
ITomRyanI
(@itomryani)
Posts: 2
New Member
Topic starter
 

@minime2k9 

Appreciate the reply.

That's interesting the use of the computers File Explorer would also store information here. I thought it would have only been Edge or IE browser information.

Kind regards,

Tom

 
Posted : 20/06/2022 10:31 am
PensiveHike
(@pensivehike)
Posts: 11
Active Member
 

Sorry, I'm late to the party.

Generally I see this when I have set an html or PDF file to be opened with a particular web browser. The "file:///U:/*folder path*/*file name*" references where the file is located on my PC.

A registry key should show the default program to be used to open a file with a particular file extension

 
Posted : 23/07/2022 12:01 am
Share:
Share to...