Examining internet history in forensic images

02 Jun 2021

There are a number of ways we can capture and present internet history data to Browser History Examiner (BHE) for analysis. Whichever method is chosen the investigator will need to mount the forensic image in order to present the internet history data to BHE, as it does not directly support the parsing of forensic image files.

Read More

Investigating web history in the new Edge Chromium browser

27 Jan 2020

Edge has joined a long list of web browsers based on the open-source Chromium browser, most notably Chrome. This means Edge now stores browsing history in an almost identical format to Chrome. Browser History Examiner and our free tools have been updated to support the new Chromium-based Edge browser.

Read More

Analysing synchronised browser history

17 Jun 2019

Both Chrome and Firefox offer the ability to sync various browser data between multiple devices by signing in with a Google or Firefox account. This data includes autofill, bookmarks, extensions, passwords, preferences, open tabs and website visits. This post will focus on syncing website visits between devices and the impact this has on an investigation involving browser history.

Read More

Analysing Firefox Session Restore data

09 May 2019

Like most web browsers Firefox includes a Session Restore feature allowing your currently open windows and tabs to be restored in the event of a forced-restart or crash. All session data is stored in a compressed file format referred to as MOZLZ4 or JSONLZ4. The file format is standard LZ4 data with a custom header. We have recently updated BHE to automatically extract session data from the sessionstore.jsonlz4 file and any files within the sessionstore-backups folder.

Read More

Recovering Edge browser history using Windows Timeline

16 Oct 2018

Web pages that are viewed using the Edge browser are visible within Windows Timeline. Our testing has shown that browser activity remains in Timeline even when the Edge browser history has been cleared. Therefore, Timeline could be a useful source of data for browser forensics, as it can potentially provide easy access to deleted browser history.

Read More

Recent Posts

Categories