Hello,
I ran across a Maxthon Browser in a case, and I was wondering if anyone has run across this browser in case work. I have conducted some searches online but can't really find forensic related material on the Maxthon Browser.
Has anyone run across this yet? Does anyone know of any tools that will parse out its history data?
Thanks,
AFAIK Maxthon is only a "shell" wrapped around IE, thus most of the data/info will be derived by the underlying Internet Explorer "engine".
jaclaz
jaclaz is right in that Maxthon is a wrapper for IE, but you can also use Gecko (Mozilla) as the engine (least you could when I used it).
Its still around today, so maybe download it and have a play around to see what is kept where.
Well, AFAIK, it has always required IE installed (and it still does)
http//
Using the Gecko engine as an alternative was something that was attempted some 4 or 5 years ago with version 1, now "Classic", but I think never went "mainstream" with version 2
http//
jaclaz
Ok, that would make sense - it was about 4 or 5 years ago I last used it.
Thanks for all the info. I found out that history2.dat is the file that resembles index.dat, though I can't find that on the system.
If I do, I wonder if any of the tools that read index.dat will read it.
Check out this forum convo - http//
Seems to indicate the Maxthon 2 history will be in the normal IE history regardless of what you do in Maxthon - the post is a little old now though.
Also this is mentioned "In case you are interested, the Maxthon history file is located in the Maxthon folder SharedAccount/your@email.com\Data\History.dat"
So might be worth looking at the IE history too to see what is there. Plus maybe look for any .dat files in the drive and see if they contain something looking like history.