Internet History De...
 
Notifications
Clear all

Internet History Deconstruction

6 Posts
5 Users
0 Reactions
519 Views
(@xaberx)
Estimable Member
Joined: 18 years ago
Posts: 105
Topic starter   [#4950]

Both Firefox and Google Chrome have changed thier history and cookie file format, Safari did aswell however it wasnt too difficult to deconstruct (went from xml to some proprietary system i think uses byte 16 as a deliminator now)

I was wondering because Firefox and Chrome now use SQL lite is there a way to open these files in access and view the data and if so what is the password to open these files, or where in the profiles can i locate it.

any programs that you know of to examine these artifacats may help aswell, i am looking to know how the easy button works for a greater understanding of this process.

Thanks in Advance,
Ryan



   
Quote
(@jelle)
Trusted Member
Joined: 19 years ago
Posts: 52
 

Hi Ryan,

My colleague Thijs Bosschert and I have recently presented on this topic at the F3 conference in the UK. You can view and even modify/delete the SQLite database records using (for example) SQLite Manager (https://addons.mozilla.org/en-US/firefox/addon/5817) - a FireFox addon.

Chrome profile data is in

%APPDATA%\Google\Chrome\ (XP)

and FF in

%APPDATA%\Mozilla\Firefox\Profiles\ (XP)

See for some FF examples this blogpost I made a while ago - our presentation will also be on the F3 website fairly soon.



   
ReplyQuote
(@armresl)
Noble Member
Joined: 22 years ago
Posts: 1011
 

I use SQLite Admin among others for sql lite files.



   
ReplyQuote
(@woany)
Eminent Member
Joined: 17 years ago
Posts: 28
 

Here are some tools

http//www.woanware.co.uk/chromeforensics/ - Chrome
http//www.firefoxforensics.com/ - Firefox



   
ReplyQuote
(@keeper)
Estimable Member
Joined: 18 years ago
Posts: 106
 

Other one just in case, SQLite Database Browser

*Single multi-platform, 2.37MB executable, no installation needed.

http//sqlitebrowser.sourceforge.net/






   
ReplyQuote
(@xaberx)
Estimable Member
Joined: 18 years ago
Posts: 105
Topic starter  

Thanks for the help I was able to read the firefox history, one thing I wqas wondering however I noticed the signons are encrypted and after researching its done in 3DES does anyone know where the cipher key is stored to decrypt the password? I have found software



   
ReplyQuote
Share: