IEF Web History Issue - Feedback Wanted

dan0841 · 2014-07-24T15:02:02Z

Hi AllI have found what I consider to be a flaw in IEF. I wanted to ask the community1) Were you aware of this 'feature'?2) Do you see it as an issue?I was examining a job involving Google Chrome (From later testing it is also an problem with Firefox). I was dual tooling by extracting live history from the HISTORY database using SQL as well as running IEF. I soon noted that IEF was displaying 10,000 live history records while my manual SQL queries of LIVE data was finding over 30,000. To cut a long story short - It appears that IEF joins the visits and urls Tables but only displays the FIRST visit to a site which has been visited multiple times along with the hit count.Therefore, if a user has visited sites which have the same URLS record but multiple visits then IEF is only displaying the FIRST visit.From my point of view this is a major issue and is not a true reflection of the Internet History.Why Is This An IssueI have a job with many 1000s of Internet searches for child abuse keywords. Due to case circumstances I was required to review the Internet History in an attempt to locate potential identifying Information (E-Mail logins, Facebook use etc) in close proximity to child abuse searches Therefore, only displaying one visit for sites which have been visited many time gives a false timeline representation of the true Internet history.I can't see any valid reason why IEF needs to do this. To me it is misrepresenting the history, or at the least giving a misleading representation. Our office is unanimous that this is a problem.What are peoples thought?I have put an IEF support ticket in but it seems that this is an intentional 'feature'. The replyTicket #3311 Chrome Web History Your request (#3311) has been updated. Reply to this email or click the link below——————————————————————————–Support, Jul 23 1643 Hi Dan,Thank you for contacting us with your inquiry.Currently IEF will join information from the "visits" and "urls" table to populate the information displayed in Report Viewer. Where the record should show the Date Visited Date/Time - The Date and Time the URL was first visited, visit count, Last Visited Date/Time etc IEF does not show every hit found in the "visits" table.May I ask if this not showing every hit found in the visits table is the "fault" which you are referring to? We do hope to overcome this by showing the visit count, and by having displayed that the information has been recovered from the tables indicated with the Source and Located at columns that the investigator can find the unique visit counts if required. Or is it rather that you are experiencing IEF is incorrectly displaying the visit count, which should be what is parsed from the "urls" table? As you have also indicated you are currently using IEF v6.4.0, we would like to let you know that IEF v6.4.1 is available and can be downloaded from http//www.magnetforensics.com/downloadief Kind regards,RegardsDan, LE Organisation