I click the cache file so it is highlighted then click "view files in native format" but still all i see is a small amount of hex and then cached graphics and html in the window below.
I can't actually see a history.dat file to click on and do this with.
Then you are not looking at the right file, in the right place, or the user does not use Firefox even though it may be installed.
Profile folder location \Documents and Settings\username\Application Data\Mozilla\Firefor\Profiles\xxxxxxxx.username
I have the same problem/thoughts, what are we missing?
In the Overview tab click on the Other Known Type button (you can also click on the Total File Items button), browse to the HISTORY.DAT file, select the file, click on the Glasses icon. You should see the file.
In the Explorer tab browse to the afore mentioned folder, highlight HISTORY.DAT. You should see the file.
You can also export the file from your case and view it in a text editor, but FTK parses all the information where a text view will need some decoding (ie. 8A=1 indicates Typed URL status).
I can do it through the "other known type" method, and could do that before. Its just been really pissing me off that i can't do it through the explore tab, the history.dat file just does not appear in that view.
There is only one profile there and that is xxxxxxxx.default. i highlight this and no history.dat is visible, i expand this and i can see two cache folders, i highlight them and i can see the cached web content but still no sign of "history.dat". x
Hi, You can download this