Internet Password

Try using a tool called net analysis, this will bring up all the internet history, temp internet files and cookies for the users of that machine. If the user has gone to a website which requires login and password and the user has said 'ok to save my details' then you may find it in the cookies folder, if not then it may only be stored in memory or on the page file which you probably not recover.

Hi All,

I am dealing with a case at the moment which is focused on Web history. I have established a lot of information but I stuck at a particular point. the person accessed a site a number of times, this site requires a user name and password to access it, where is the best place to look establish if the password has been cached locally, I have forensically analysed temp internet folder but cannot find anything. The machine is a windows 98 machine…

Can anyone point me in the right direction.

kaly…

Apologies for not answering your question directly but can I ask why the case needs this password?

Often cookies will not log the raw passwords (well unless it is 10 or so years ago when they were not as security concious).

If the user has selected to save the passwords when using IE then these are placed into the registry. Unfortunately my brain fails me here as I can not remember the exact key area that Windows 98 stores these. They will be in the protected storage area.

Passwords from Win 98 are encrypted and stored in the registry under the Protected Storage System key (I t. It should be in the User Hive of the registry, I have not worked on 98 in many years but you might find something to get you that at Nirsoft.net.

Or boot the image you made using VMWare and LiveView then you could use utils that will pulls the passwords out of the live system, again check Nirsoft.net.
http//www.nirsoft.net/utils/pspv.html

Mark