Internet History De...
 
Notifications
Clear all

Internet History Deconstruction

6 Posts
5 Users
0 Reactions
347 Views
(@xaberx)
Estimable Member
Joined: 17 years ago
Posts: 105
Topic starter  

Both Firefox and Google Chrome have changed thier history and cookie file format, Safari did aswell however it wasnt too difficult to deconstruct (went from xml to some proprietary system i think uses byte 16 as a deliminator now)

I was wondering because Firefox and Chrome now use SQL lite is there a way to open these files in access and view the data and if so what is the password to open these files, or where in the profiles can i locate it.

any programs that you know of to examine these artifacats may help aswell, i am looking to know how the easy button works for a greater understanding of this process.

Thanks in Advance,
Ryan


   
Quote
(@jelle)
Trusted Member
Joined: 18 years ago
Posts: 52
 

Hi Ryan,

My colleague Thijs Bosschert and I have recently presented on this topic at the F3 conference in the UK. You can view and even modify/delete the SQLite database records using (for example) SQLite Manager (https://addons.mozilla.org/en-US/firefox/addon/5817) - a FireFox addon.

Chrome profile data is in

%APPDATA%\Google\Chrome\ (XP)

and FF in

%APPDATA%\Mozilla\Firefox\Profiles\ (XP)

See for some FF examples this blogpost I made a while ago - our presentation will also be on the F3 website fairly soon.


   
ReplyQuote
(@armresl)
Noble Member
Joined: 21 years ago
Posts: 1011
 

I use SQLite Admin among others for sql lite files.


   
ReplyQuote
(@woany)
Eminent Member
Joined: 16 years ago
Posts: 28
 

Here are some tools

http//www.woanware.co.uk/chromeforensics/ - Chrome
http//www.firefoxforensics.com/ - Firefox


   
ReplyQuote
(@keeper)
Estimable Member
Joined: 17 years ago
Posts: 106
 

Other one just in case, SQLite Database Browser

*Single multi-platform, 2.37MB executable, no installation needed.

http//sqlitebrowser.sourceforge.net/





   
ReplyQuote
(@xaberx)
Estimable Member
Joined: 17 years ago
Posts: 105
Topic starter  

Thanks for the help I was able to read the firefox history, one thing I wqas wondering however I noticed the signons are encrypted and after researching its done in 3DES does anyone know where the cipher key is stored to decrypt the password? I have found software


   
ReplyQuote
Share: