Safari Cache.db dat...
 
Notifications
Clear all

Safari Cache.db data carving

6 Posts
4 Users
0 Reactions
609 Views
Spcavana
(@spcavana)
Active Member
Joined: 17 years ago
Posts: 14
Topic starter  

I am aware of File Juicer for data carving the cache.db file for Safari. However, I am attempting to obtain similar results using a windows based data carver. I have attempted to use WinHex's File Recovery by Type function, but have only obtained a few semi-corrupted jpeg and png pictures. I am in the process of running EnCase's File Finder.

Does anyone have any recommendations for getting similar results utilizing a windows based data carver??

Thanks in advance!


   
Quote
darren_q
(@darren_q)
Eminent Member
Joined: 20 years ago
Posts: 48
 

Try Photorec (which does more than photos!)

http//www.cgsecurity.org/wiki/PhotoRec


   
ReplyQuote
Spcavana
(@spcavana)
Active Member
Joined: 17 years ago
Posts: 14
Topic starter  

Update EnCase's File Finder function in Case Processor works pretty well for pictures, but I have not had a chance to use the program recommended by darren_q.


   
ReplyQuote
(@ddewildt)
Estimable Member
Joined: 17 years ago
Posts: 123
 

I echo darren_q's reccommendation for photorec, worked great for me on a recent case


   
ReplyQuote
(@indur)
Trusted Member
Joined: 17 years ago
Posts: 67
 

I would avoid using a file carver, if possible. Cache.db is an SQLite database, and its contents can be accessed using an SQLite database browser. You're probably getting partially corrupted files because the data in the database isn't necessarily contiguous.


   
ReplyQuote
Spcavana
(@spcavana)
Active Member
Joined: 17 years ago
Posts: 14
Topic starter  

Photorec did not work due to the fact that I am carving a file, not a volume; Photorec only works on volumes.

I used CacheBack with great success. I highly recommend CacheBack for parsing and rebuilding web pages. Very easy to use and works very well.

Thanks to everyone for input.


   
ReplyQuote
Share: