Hi everyone!
I am fairly new to this, so go easy on me if I have simply overlooked something obvious.
I am trying to view Hotmail messages stored in a Firefox (v.1) cache. I have followed the advice given in the article on Web Browser Forensics at
http//
Using Cache View I am able to recover and view pretty much all the HTML pages from other sites, but can't seem to recover any of the Hotmail pages. Cache View identifies the correct file date and size for each page, but when I try to copy them, each exported file is 0 bytes. If I attempt to open the file directly from Cache View (whether in a browser or notepad) I get a blank page.
The files are identified as being encrypted with gzip, but having followed the instructions in the article above, gzip says they are not gzip files.
Can anyone suggest what I am doing wrong?
Anyone?
I can't really say with Cacheview…. I usually sacrifice myself and go though the cache manually and reconstruct as needed. I have had alot of problems with Cacheview in the past and rarely use it now.
Thanks for responding, BraneRift.
I agree, Cache View has its problems. The difficulty in reconstructing the pages manually is that they are encrypted in the cache. I have tried other viewers, but with the same results. It only seems to be Hotmail pages, others are no problem.
Is there something different about the way Hotmail is constructed or is it a Firefox thing?
I've stopped using Cache View because the results are inconsistent. As for Firefox and Hotmail (or Yahoo mail, or others), it's likely that the problem you're encountering is related to Firefox storing the cached email messages in compressed (gzip) format.
Try having a look at the Firefox cache directory (you can type aboutcache in the address line to find out exactly where the directory is) and run a Win32 port of the Unix 'file' command to see which files are "gzip archives". You can rename these files to have a .gz extension and then run a Win32 port of gzip on them (gzip -d <file>) to reveal the contents in plain text.
If you have FTK, it processes the files in the Firefox cache directory properly (they're identified as being compressed and you can view them from within FTK).
Best,
–Golden