500.5 - Internet Browsers

Question 1

What can we find during browser forensics?

Answer 1

• History
• Cache
• Cookies

Question 2

IE8 and IE9 Data Locations

Answer 2

• Metadata sored in index.dat
• History, Cache, Cookies, Download History

Location

• %USERPROFILES%\AppData\Local\Microsoft\Windows\
• %USERPROFILES%\AppData\Roaming\Microsoft\Windows

Question 3

IE 10 Data Locations

Answer 3

• Metatdata stored in WebCacheV*.dat
• Storage of Cookes and Cache are in Temp Internet Files

Location
- %USERPROFILE%\AppData\Local\Microsoft\Windows\Webcache

Question 4

IE 11 Data Locations

Answer 4

• Metatdata stored in WebCacheV*.dat
• Storage data for Cache & Cookies is in INetCache & INetCookies

Location
- %USERPROFILE%\AppData\Local\Microsoft\Windows\INet…

Question 5

Internet Explorer History

Answer 5

• 20 days
• Records URL, date/time, local user, tracks access of local system
• Stored in multiple Index.dat (IE4-9) ORR in WebCacheV*.dat (IE10+) files
• Registry determines time span of records kept
• Hard for users to clear/manipulate

Location
- SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\URL History

Question 6

WebCacheV*.dat

Answer 6

• Most important file in IE10
  
  • Replaces index.dat files & store data for nearly every IE artifact
• New Format: Extensible Storage Engine (ESE)
• Filename varries:
  
  • WebCacheVo1.dat,
  • WebCacheV16.dat,
  • WebCacheV24.dat
• Legacy folders still exist (Hist.IE5 & Cont.IE5)
  
  • Container.dat files in these folders are placeholders
  • Actual Metadata is recorded in WebCacheV*.dat file

Location
- %USERPROFILE%\AppData\Local\Microsoft\Windows\Webcache

Question 7

Parsing WebCacheV*.dat

Answer 7

Consists of:

• ContainerID - Idenifier for each table assigned to an IE artifact
• Last access time - Last update time for table
• Name - Type of table (“History” == IE History)
• Directory - Location of artifacts in the filesystem
• NirSoft OR ESEDatabaseView

Question 8

WebCacheV*.dat History Tables

Answer 8

Consists of:

• Modified Time (First) - First access time object referenced in URL field
• Access time(Last) - Last access time object referenced in URL field
• Access count - number of times URL visited - not accurate
• URL - Resource being accessed (website, file, or other object)