Can anyone tell me where to find, within a forensic image, the value of the number days history stored by Firefox? How would I tell if the user has unticked the 'keep history' option?
I know where to find this info for IE but can't find it for Firefox. Have already tried to boot the image with Live View but no joy.
Thanks.
If you go to c\documents and settings\<username>\application data\Mozilla\Firefox\profiles.ini it will give the path to the profile for the user. In there you will find the pref.js file. If that does not contain what you are looking for, look at the other items in that folder.
The number of days that history is kept is 90 by default and that default value is not stored in the prefs.js unless it is changed. If it is changed, it is stored as user_pref("browser.history_expire_days_min", XX) where "XX" is the number of days.
I tested on Firefox v3
Many thanks Greg, appreciated. Will use this on my case when I return to the office after the weekend.