±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34595
New Yesterday: 0 Visitors: 188

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Firefox 3 Deleted History Analysis

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Firefox 3 Deleted History Analysis

Post Posted: Tue Mar 22, 2011 7:25 am

I was wondering what tools / methods people are using for analysis of deleted Firefox 3 history records?

NetAnalysis now does the cache records but does not do the deleted SQLITE history records from unallocated etc. There are also many tools for analysing the live sqlite databases but there do not appear to be any commercial tools which locate deleted history.  

dan0841
Senior Member
 
 
  

Re: Firefox 3 Deleted History Analysis

Post Posted: Tue Mar 22, 2011 7:43 am

- dan0841
I was wondering what tools / methods people are using for analysis of deleted Firefox 3 history records?

NetAnalysis now does the cache records but does not do the deleted SQLITE history records from unallocated etc. There are also many tools for analysing the live sqlite databases but there do not appear to be any commercial tools which locate deleted history.


Please try our Belkasoft Evidence Center. Write me PM if there are any questions about the product.  

Belkasoft
Senior Member
 
 
  

Re: Firefox 3 Deleted History Analysis

Post Posted: Tue Mar 22, 2011 8:07 am

I was reading up on internet browser this morning for something I am working on and came across this, that may be of interested to you.

forensicsfromthesausag...s-you.html  

diesel
Member
 
 
  

Re: Firefox 3 Deleted History Analysis

Post Posted: Thu Mar 24, 2011 7:11 am

- diesel
I was reading up on internet browser this morning for something I am working on and came across this, that may be of interested to you.

forensicsfromthesausag...s-you.html


None of the tools described in that article appear to deal with the deleted SQLite records, mainly live files and deleted cached records only.

Same appears to apply to the belkasoft program mentioned earlier.  

minime2k9
Senior Member
 
 
  

Re: Firefox 3 Deleted History Analysis

Post Posted: Thu Mar 24, 2011 10:07 am

The paper "Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records" ( www.sciencedirect.com/...archtype=a ) can be helpfull.
The author cites these tools:
FoxAnalysis (http://www.forensic-software.co.uk)
Firefox Forensics (http://www.machor-software.com)
Firefox 3 Extractor (http://www.firefoxforensics.com)
And he wrote this other tool:
Firefox 3 History Recovery (http://ff3hr.sourceforge.net/)  

mars4
Newbie
 
 
  

Re: Firefox 3 Deleted History Analysis

Post Posted: Thu Mar 24, 2011 10:46 am

Id take it though that people are generally just dealing with the live profiles as opposed to the deleted records?

Mars4 - 3 of those programs deal exclusively with live files and the ff3hr only works for firefox 3.0 as the record structure changed as at 3.5+ and it crashes out on most machines.  

minime2k9
Senior Member
 
 
  

Re: Firefox 3 Deleted History Analysis

Post Posted: Thu Mar 24, 2011 1:23 pm

- minime2k9
Mars4 - 3 of those programs deal exclusively with live files and the ff3hr only works for firefox 3.0 as the record structure changed as at 3.5+ and it crashes out on most machines.


Could you not play with the code:
cdnetworks-us-2.dl.sou...3hr1.2.cpp

And edit to work with the newer structure?  

douglasbrush
Senior Member
 
 

Page 1 of 2
Go to page 1, 2  Next