Firefox history.dat...
 
Notifications
Clear all

Firefox history.dat partially deleted

2 Posts
2 Users
0 Reactions
368 Views
(@englishgit)
Eminent Member
Joined: 18 years ago
Posts: 22
Topic starter  

I need help with this case I'm doing. I have found and recovered the standard Firefox history.dat file for a user. This is the main browser they've been using. I then used a nifty little program named DORK to translate it all into a readable table. The problem is that I've now found further records that look similar in unallocated clusters, but it's only part of the file. I've tried rebuilding the file using the full one I recovered, but I cannot seem to get it right. Can anyone advise me on how dates and times are stored in history.dat files for Firefox?

As a side note, I've also found a few days internet history, but absoloutely no html pages corresponding with them. Not even fragments. Can't find any wiping software installed. Any ideas?

I'd appreciate any suggestions.


   
Quote
azrael
(@azrael)
Honorable Member
Joined: 19 years ago
Posts: 656
 

Have a look at http//philwilson.org/blog/2005/01/how-to-export-firefoxs-history-to-text.html this has other links as well to some Perl scripts to parse the history.dat file.

Incidentally, an interesting selection of information from within the Perl Script
# In Netscape Navigator 1.0 through 4.0, the history.db file was just a
# Berkeley DBM file. You could trivially bind to it from Perl, and
# pull out the URLs and last-access time. In Mozilla, this has been
# replaced with a "Mork" database for which no tools exist.
#
# Let me make it clear that McCusker is a complete barking lunatic.
# This is just about the stupidest file format I've ever seen.
#
# http//www.mozilla.org/mailnews/arch/mork/primer.txt
# http//jwz.livejournal.com/312657.html
# http//www.jwz.org/doc/mailsum.html
# http//bugzilla.mozilla.org/show_bug.cgi?id=241438
#
# In brief, let's count its sins
#
# - Two different numerical namespaces that overlap.
#
# - It can't decide what kind of character-quoting syntax to use
# Backslash? Hex encoding with dollar-sign?
#
# - C++ line comments are allowed sometimes, but sometimes // is just
# a pair of characters in a URL.
#
# - It goes to all this serious compression effort (two different
# string-interning hash tables) and then writes out Unicode strings
# without using UTF-8 writes out the unpacked wchar_t characters!
#
# - Worse, it hex-encodes each wchar_t with a 3-byte encoding,
# meaning the file size will be 3x or 6x (depending on whether
# whchar_t is 2 bytes or 4 bytes.)
#
# - It masquerades as a "textual" file format when in fact it's just
# another binary-blob file, except that it represents all its magic
# numbers in ASCII. It's not human-readable, it's not hand-editable,
# so the only benefit there is to the fact that it uses short lines
# and doesn't use binary characters is that it makes the file bigger.
# Oh wait, my mistake, that isn't actually a benefit at all.
#
# Pure comedy.
#
# Copyright © 2004 Jamie Zawinski

-)


   
ReplyQuote
Share: