Bookmarks, Cached Files, Cookies, Downloads, Favicons, Form History, Logins, Searches, Session Data, Thumbnails, Website Visits
Windows Vista or newer (32-bit and 64-bit versions)
Microsoft .NET Framework 4.0 or higher
No installation is required on the remote machine you just need administrator access to it (either local or domain admin).
You don't need to install BHE on each computer you wish to analyse history from, you can simply use our capture process to pull history from other computers onto your computer where BHE is installed.
Yes, you will need to mount the forensic image first as BHE does not directly support parsing forensic image files. Once the image is mounted as read-only you can simply point BHE at the appropriate Windows user profile within the mounted drive.
The 'Visit Count' column is the count stored by the web browser, which generally gets incremented everytime the user visits a particular URL, however this can depend on how the URL was navigated to. For example, Chrome does not increment the visit count when a page is reloaded. The 'URL Record Count' column is the count of Website Visit records containing the same URL for a single browser (irrespective of how the URL was navigated to). The two counts will often match, however the URL Record Count may be greater if some website visits were page reloads for example, and the Visit Count may be greater if some website visit records have been deleted.
You can view the licence agreement here.