Analysing browser site settings

12 Sep 2022

In Chromium browsers such as Chrome and Edge there are various settings that allow you to control the browser's behaviour on a per-website basis. To more easily access this data we’ve updated BHE to include a new Site Settings artifact which automatically parses this data from the Preferences file.

Read More

Analysing synchronised browser history

17 Jun 2019

Both Chrome and Firefox offer the ability to sync various browser data between multiple devices by signing in with a Google or Firefox account. This data includes autofill, bookmarks, extensions, passwords, preferences, open tabs and website visits. This post will focus on syncing website visits between devices and the impact this has on an investigation involving browser history.

Read More

Analysing Firefox Session Restore data

09 May 2019

Like most web browsers Firefox includes a Session Restore feature allowing your currently open windows and tabs to be restored in the event of a forced-restart or crash. All session data is stored in a compressed file format referred to as MOZLZ4 or JSONLZ4. The file format is standard LZ4 data with a custom header. We have recently updated BHE to automatically extract session data from the sessionstore.jsonlz4 file and any files within the sessionstore-backups folder.

Read More

Browser History Examiner v1.5 released

10 Feb 2016

Browser History Examiner v1.5 is now available to download. New features include: Extracting Email Addresses, Linking Form History to Web Page URLs and Searching Cached JSON Content.

Read More

Analysing Skype contacts in the browser cache

14 Jan 2016

In the past it has been possible to recover artefacts for various online services such as Facebook and Gmail from the browser cache on disk. This was most likely due to different browser behaviour, incorrect use of HTTP headers in responses and a lack of consideration over data privacy.

Read More

Recent Posts

Categories