Frequently asked questions



Which web browsers are supported?

What data types are extracted?

Bookmarks, Cached Files, Cookies, Downloads, Favicons, Form History, Logins, Searches, Session Data, Thumbnails, Website Visits

What are the system requirements?

Windows Vista or newer (32-bit and 64-bit versions)
Microsoft .NET Framework 4.0 or higher

What is required to perform a remote capture?

No installation is required on the remote machine you just need administrator access to it (either local or domain admin).

How many installations do I need?

You don't need to install BHE on each computer you wish to analyse history from, you can simply use our capture process to pull history from other computers onto your computer where BHE is installed.

Can I load history from a forensic image?

Yes, you will need to mount the forensic image first as BHE does not directly support parsing forensic image files. Once the image is mounted as read-only you can simply point BHE at the appropriate Windows user profile within the mounted drive.

What is the difference between the Visit Count and URL Record Count columns?

The 'Visit Count' column is the count stored by the web browser, which generally gets incremented everytime the user visits a particular URL, however this can depend on how the URL was navigated to. For example, Chrome does not increment the visit count when a page is reloaded. The 'URL Record Count' column is the count of Website Visit records containing the same URL for a single browser (irrespective of how the URL was navigated to). The two counts will often match, however the URL Record Count may be greater if some website visits were page reloads for example, and the Visit Count may be greater if some website visit records have been deleted.

EULA

You can view the licence agreement here.