looking in to HTML 5 and in particular the LocalStorage object.
Has anyone carried out any work to determine the forensic potential of this new tag ??
Very much dependant on the site visited, there is a massive potential here for artefacts helpful within an investigation.
Any thoughts within our community ?? I would be grateful to hear.
Cheers.
Colin
Done a lot of work on these artefacts, especially on Android and iOS.
Google and Yahoo make good use of the Webkit SQLite interface - some really rich data generated as a result of minimal user interaction (eg emails downloaded and stored on the local machine without the user actively reading them in that session.) The Facebook mobile site does some neat stuff as well.
There are two main APIs as far as I have seen the Key-value storage which is more basic and webkit supports a full SQLite API where you'll have full, structured databases. Tasty.
Certainly on iOS the databases are pretty lax on clearing themselves up so you can usually get some deleted data back from them as well.