1 Computer Forensics Dr. Randy M. Kaplan

2 Browser Forensics

A Source of Evidence Critical Evidence can often be found in a subject’s browsing history s Sites visited Internet searches Computer Forensics 3

Browsers Two are dominant IE Mozilla (and its derivatives and variants) Computer Forensics 4

IE Activity stored in – C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5 Contains Cached pages Images Two other files of interest History without locally cached content C:\Documents and Settings\user\History\History.IE5 Cookies C:\Documents and Settings\user\Cookies Computer Forensics 5

Index.dat In each of these directories there is a file named index.dat The relationship between cached web content and URLs is maintained in this file Computer Forensics 6

Mozilla Web activity maintained in a file named history.dat File located in – C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\ \history.dat C:\Documents and Settings\user\Application Data\Mozilla\Profiles\ \ \history.dat Computer Forensics 7

Mozilla history.dat differs from IE Does not link web site activity to cached web pages More difficult to reconstruct the activity Computer Forensics 8

Tools Web Historian A tool used to reconstruct web activity Applicable to – IE Mozilla Firefox Netscape Safari Opera Computer Forensics 9

Downloading Web Historian Web Historian can be downloaded from – _ html Computer Forensics 10

Web Historian Computer Forensics 11

Web Historian Computer Forensics 12

Web Historian Computer Forensics 13 Lots and lost of information produced by Web Historian

Web Historian Suppose my wife wanted to know what I have been doing on the Internet (Maybe she wants to make sure I am not spending the kid’s college fund) What evidence in the generated file would give her the kinds of information she is looking for? Computer Forensics 14

Web Historian Scan the URL addresses Computer Forensics 15

Web Historian Scan the URL addresses Computer Forensics 16

Trying Firefox Set WH to Firefox directory What are the results? Computer Forensics 17

Trying Firefox Computer Forensics 18

Trying Firefox Computer Forensics 19 Very odd because this is my default browser

Web Historian Not really clear why WH does not work with Firefox Try alternative Computer Forensics 20

Cache View Cache View can be downloaded from – Computer Forensics 21

Cache View Download and install Computer Forensics 22

Cache View Need to point Cache View to the proper directory Computer Forensics 23

Cache View Point to the proper directory Computer Forensics 24

Cache View Computer Forensics 25

Cache View Computer Forensics 26

Cache View Computer Forensics 27

How To Use? Clearly having a record of someone’s web activities can be used to determine what they have doing For example if a subject was interested in learning how to hack a particular system then accessing web sites to learn how to do this would substantiate this theory Computer Forensics 28

How To Use? If a subject uses a web interface for then we can tell if he accessed it and we can also see what the status of the access was at that time Computer Forensics 29