DOCSLIB.ORG

Forensic Internet History Analysis

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Forensic Internet History Analysis FORENSIC INTERNET HISTORY ANALYSIS SOFTWARE Copyright © 2004-09 Digital Detective Written by Craig Wilson Revision: 1.37.0.9018 Date: 02 March 2009 NetAnalysis Forensic Internet History Analysis Page 2 of 109 Table of Contents Table of Contents ............................................................................................................................... 2 Introduction......................................................................................................................................... 5 Welcome to NetAnalysis..................................................................................................................................................5 Feature List......................................................................................................................................... 6 NetAnalysis Key Features ...............................................................................................................................................6 Understanding the User Interface....................................................................................................... 7 Getting to know NetAnalysis............................................................................................................................................7 The Toolbar .....................................................................................................................................................................8 Shortcut Keys ................................................................................................................................................................10 Status Bar......................................................................................................................................................................11 Configuring NetAnalysis ................................................................................................................... 12 Setting properties ..........................................................................................................................................................12 Identification of Suspect Computer Time Zone ................................................................................ 15 Establishing a Time Zone Basis ....................................................................................................................................15 Examining the Registry..................................................................................................................................................15 Calculating Signed Integer Bias Values ........................................................................................................................17 ActiveTimeBias..............................................................................................................................................................20 Working out when Daylight Saving or Standard Time Commences..............................................................................21 Microsoft Internet Explorer ............................................................................................................... 23 History of a Web Browser..............................................................................................................................................23 MSIE Browser Data .......................................................................................................................... 25 Forensic Analysis of MS Internet Explorer ....................................................................................................................25 Internet Explorer History List .........................................................................................................................................26 A More Detailed Look ....................................................................................................................................................27 Daily INDEX.DAT Files..................................................................................................................................................28 Weekly INDEX.DAT Files ..............................................................................................................................................29 Master INDEX.DAT File.................................................................................................................................................29 Filtering Master, Daily & Weekly....................................................................................................................................31 Temporary Internet Files ...............................................................................................................................................31 Registry Artefacts ............................................................................................................................. 34 Introduction to Registry..................................................................................................................................................34 SHELL Folders ..............................................................................................................................................................34 Days to Keep .................................................................................................................................................................35 Cache Size ....................................................................................................................................................................35 Typed URLS ..................................................................................................................................................................37 Internet Explorer Start Page ..........................................................................................................................................38 MS Internet Explorer Cookies........................................................................................................... 39 Introduction to Cookies..................................................................................................................................................39 Persistent & Session Cookies .......................................................................................................................................39 Cookie Transport Security.............................................................................................................................................39 First & Third Party Cookies............................................................................................................................................40 How do cookies work?...................................................................................................................................................40 Forensic Analysis of Cookie Data..................................................................................................................................42 Manual Decoding of Cookie Dates................................................................................................................................44 Cookie Myths & Defences .............................................................................................................................................46 Copyright © 2004-2009 by Digital Detective Craig Wilson NetAnalysis Forensic Internet History Analysis Page 3 of 109 Forensic Benefit of Cookies...........................................................................................................................................46 MSIE Browser Forensic Analysis ..................................................................................................... 47 Data Extraction ..............................................................................................................................................................47 Exporting Data...............................................................................................................................................................47 Netscape Browser ............................................................................................................................ 50 Netscape History ...........................................................................................................................................................50 Netscape Browser Data.................................................................................................................... 52 Forensic Analysis of Netscape ......................................................................................................................................52 Netscape Communicator/Navigator Version 4.8 ...........................................................................................................52 Extraction of Netscape 4.8 ............................................................................................................................................53 Netscape Version 6 - 8 ..................................................................................................................................................54 Netscape Browser Data Files ........................................................................................................................................54
Load more

Recommended publications
  • HTTP Cookie - Wikipedia, the Free Encyclopedia 14/05/2014
    HTTP cookie - Wikipedia, the free encyclopedia 14/05/2014 Create account Log in Article Talk Read Edit View history Search HTTP cookie From Wikipedia, the free encyclopedia Navigation A cookie, also known as an HTTP cookie, web cookie, or browser HTTP Main page cookie, is a small piece of data sent from a website and stored in a Persistence · Compression · HTTPS · Contents user's web browser while the user is browsing that website. Every time Request methods Featured content the user loads the website, the browser sends the cookie back to the OPTIONS · GET · HEAD · POST · PUT · Current events server to notify the website of the user's previous activity.[1] Cookies DELETE · TRACE · CONNECT · PATCH · Random article Donate to Wikipedia were designed to be a reliable mechanism for websites to remember Header fields Wikimedia Shop stateful information (such as items in a shopping cart) or to record the Cookie · ETag · Location · HTTP referer · DNT user's browsing activity (including clicking particular buttons, logging in, · X-Forwarded-For · Interaction or recording which pages were visited by the user as far back as months Status codes or years ago). 301 Moved Permanently · 302 Found · Help 303 See Other · 403 Forbidden · About Wikipedia Although cookies cannot carry viruses, and cannot install malware on 404 Not Found · [2] Community portal the host computer, tracking cookies and especially third-party v · t · e · Recent changes tracking cookies are commonly used as ways to compile long-term Contact page records of individuals' browsing histories—a potential privacy concern that prompted European[3] and U.S.
    [Show full text]
  • Web Browser a C-Class Article from Wikipedia, the Free Encyclopedia
    Web browser A C-class article from Wikipedia, the free encyclopedia A web browser or Internet browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier (URI) and may be a web page, image, video, or other piece of content.[1] Hyperlinks present in resources enable users to easily navigate their browsers to related resources. Although browsers are primarily intended to access the World Wide Web, they can also be used to access information provided by Web servers in private networks or files in file systems. Some browsers can also be used to save information resources to file systems. Contents 1 History 2 Function 3 Features 3.1 User interface 3.2 Privacy and security 3.3 Standards support 4 See also 5 References 6 External links History Main article: History of the web browser The history of the Web browser dates back in to the late 1980s, when a variety of technologies laid the foundation for the first Web browser, WorldWideWeb, by Tim Berners-Lee in 1991. That browser brought together a variety of existing and new software and hardware technologies. Ted Nelson and Douglas Engelbart developed the concept of hypertext long before Berners-Lee and CERN. It became the core of the World Wide Web. Berners-Lee does acknowledge Engelbart's contribution. The introduction of the NCSA Mosaic Web browser in 1993 – one of the first graphical Web browsers – led to an explosion in Web use. Marc Andreessen, the leader of the Mosaic team at NCSA, soon started his own company, named Netscape, and released the Mosaic-influenced Netscape Navigator in 1994, which quickly became the world's most popular browser, accounting for 90% of all Web use at its peak (see usage share of web browsers).
    [Show full text]
  • Opengis® Web Map Server Cookbook
    Open GIS Consortium Inc. OpenGIS® Web Map Server Cookbook August 18, 2003 Editor: Kris Kolodziej OGC Document Number: 03-050r1 Version: 1.0.1 Stage: Draft Language: English OpenGIS® Web Map Server Cookbook Open GIS Consortium Inc. Copyright Notice Copyright 2003 M.I.T. Copyright 2003 ESRI Copyright 2003 Bonn University Copyright 2003 lat/lon Copyright 2003 DM Solutions Group, Inc Copyright 2003 CSC Ploenzke AG Copyright 2003 Wupperverband Copyright 2003 WirelessInfo Copyright 2003 Intergraph Copyright 2003 Harvard University Copyright 2003 International Interfaces (See full text of copyright notice in Appendix 2.) Copyright 2003 York University Copyright 2003 NASA/Ocean ESIP, JPL The companies and organizations listed above have granted the Open GIS Consortium, Inc. (OGC) a nonexclusive, royalty-free, paid up, worldwide license to copy and distribute this document and to modify this document and distribute copies of the modified version. This document does not represent a commitment to implement any portion of this specification in any company’s products. OGC’s Legal, IPR and Copyright Statements are found at http://www.opengis.org/legal/ipr.htm . Permission to use, copy, and distribute this document in any medium for any purpose and without fee or royalty is hereby granted, provided that you include the above list of copyright holders and the entire text of this NOTICE. We request that authorship attribution be provided in any software, documents, or other items or products that you create pursuant to the implementation of the contents of this document, or any portion thereof. No right to create modifications or derivatives of OGC documents is granted pursuant to this license.
    [Show full text]
  • Redes De Ordenadores WWW
    Informática Técnica de Gestión Redes de ordenadores WWW Grupo de sistemas y comunicaciones [email protected] Redes de ordenadores, 1998-1999 GSYC Página 1 Informática Técnica de Gestión 3 8. WWW World Wide Web (la telaraña mundial) es un sistema de información hipermedia que ha revolucionado Internet en los años 90. Se basa en un protocolo de trasferencia de información (HTTP), que utilizan los programas cliente (navegador o browser) para recuperar datos en forma de páginas en un formato normalizado (HTML) provenientes de servidores dispersos por Internet. El usuario puede seleccionar otras páginas definidas mediante URLs que aparecen resaltadas en las páginas como hiperenlaces mediante un interfaz amigable. La publicitación es un método rápido (porque la actualización tiene efectos inmediatos en quienes acceden a la información) y económico de poner información a disposición de cualquiera(en todo el mundo) que tome la iniciativa (igualdad de oportunidades) de pedirla. El modelo inicial de navegar de página en página buscando información se ha enriquecido con la proliferación de herramientas de búsqueda (spiders, crawlers, robots) así como el acceso a páginas generadas dinámicamente como respuesta a consultas interactivas (CGI). Las capacidades iniciales de visualización se han extendido con la evolución de HTML y la aparición de otros lenguajes para representación de objetos tridimensionales (VRML), ejecución en local de aplicaciones (JAVA)... aumentando la interactividad. La riqueza del entorno ha provocado una demanda para incorporarle características de seguridad mejorada (SSL) que permitan extender el modelo de acceso a la información a aspectos que pueden cambiar tanto el mundo como el comercio electrónico (SET).
    [Show full text]
  • Web Browsing and Communication Notes
    digital literacy movement e - learning building modern society ITdesk.info – project of computer e-education with open access human rights to e - inclusion education and information open access Web Browsing and Communication Notes Main title: ITdesk.info – project of computer e-education with open access Subtitle: Web Browsing and Communication, notes Expert reviwer: Supreet Kaur Translator: Gorana Celebic Proofreading: Ana Dzaja Cover: Silvija Bunic Publisher: Open Society for Idea Exchange (ODRAZI), Zagreb ISBN: 978-953-7908-18-8 Place and year of publication: Zagreb, 2011. Copyright: Feel free to copy, print, and further distribute this publication entirely or partly, including to the purpose of organized education, whether in public or private educational organizations, but exclusively for noncommercial purposes (i.e. free of charge to end users using this publication) and with attribution of the source (source: www.ITdesk.info - project of computer e-education with open access). Derivative works without prior approval of the copyright holder (NGO Open Society for Idea Exchange) are not permitted. Permission may be granted through the following email address: [email protected] ITdesk.info – project of computer e-education with open access Preface Today’s society is shaped by sudden growth and development of the information technology (IT) resulting with its great dependency on the knowledge and competence of individuals from the IT area. Although this dependency is growing day by day, the human right to education and information is not extended to the IT area. Problems that are affecting society as a whole are emerging, creating gaps and distancing people from the main reason and motivation for advancement-opportunity.
    [Show full text]
  • Guideline for Securing Your Web Browser P a G E | 2
    CMSGu2011-02 CERT-MU SECURITY GUIDELINE 2011 - 02 Mauritian Computer Emergency Response Team Enhancing Cyber Security in Mauritius Guideline For Securing Your Web Browser National Computer Board Mauritius JuJunene 2011 2011 Version 1.7 IssueIssue No. No. 4 2 National Computer Board © Table of Contents 1.0 Introduction .......................................................................................................................... 7 1.1 Purpose and Scope ........................................................................................................... 7 1.2 Audience........................................................................................................................... 7 1.3 Document Structure.......................................................................................................... 7 2.0 Background .......................................................................................................................... 8 3.0 Types of Web Browsers ....................................................................................................... 9 3.1 Microsoft Internet Explorer .............................................................................................. 9 3.2 Mozilla Firefox ................................................................................................................. 9 3.3 Safari ................................................................................................................................ 9 3.4 Chrome ..........................................................................................................................
    [Show full text]
  • Web Browsers
    WEB BROWSERS Page 1 INTRODUCTION • A Web browser acts as an interface between the user and Web server • Software application that resides on a computer and is used to locate and display Web pages. • Web user access information from web servers, through a client program called browser. • A web browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web Page 2 FEATURES • All major web browsers allow the user to open multiple information resources at the same time, either in different browser windows or in different tabs of the same window • A refresh and stop buttons for refreshing and stopping the loading of current documents • Home button that gets you to your home page • Major browsers also include pop-up blockers to prevent unwanted windows from "popping up" without the user's consent Page 3 COMPONENTS OF WEB BROWSER 1. User Interface • this includes the address bar, back/forward button , bookmarking menu etc 1. Rendering Engine • Rendering, that is display of the requested contents on the browser screen. • By default the rendering engine can display HTML and XML documents and images Page 4 HISTROY • The history of the Web browser dates back in to the late 1980s, when a variety of technologies laid the foundation for the first Web browser, WorldWideWeb, by Tim Berners-Lee in 1991. • Microsoft responded with its browser Internet Explorer in 1995 initiating the industry's first browser war • Opera first appeared in 1996; although it have only 2% browser usage share as of April 2010, it has a substantial share of the fast-growing mobile phone Web browser market, being preinstalled on over 40 million phones.
    [Show full text]
  • Etude Des Différentes Approches D'accès À Internet Pour Les Non
    Etude des différentes approches d’accès à Internet pour les non-voyants Siwar Farhat(1) (2) , Yacine Bellik(2) , Thierry Ducros(1) , Françoise Néel(2) , Daniel Teil(2) (1) TECHNIBRAILLE ZAE, 4, rue Léon Blum, 91120 Palaiseau Tél. : (33) (1)-69-19-47-57 Fax : (33) (1)-69-32-11-05 (2) LIMSI-CNRS B.P. 133, 91403 Orsay Tél. : (33) (1)-69-85-80-64 Fax: (33) (1)-69-85-80-88 E-mail:[email protected], [email protected], [email protected], [email protected], [email protected] Résumé L’accès à Internet représente une opportunité intéressante pour les non-voyants et leur permet de profiter d’un nombre important de ressources et d’informations mises à la disposition de tous, telles que les pages HTML (HyperText Markup Language), le courrier électronique et le téléchargement de fichiers. Les documents HTML utilisent abondamment les possibilités multimédia, des ordinateurs actuels. Ils peuvent donc intégrer du texte, des images, des animations, des fichiers audio, vidéo, etc. Le fait que les pages HTML exploitent ces caractéristiques multimédia pose un problème d’accès pour les non-voyants. Afin de permettre à un non-voyant d’accéder aux pages HTML, des méthodes efficaces d’interaction et de présentation de l’information électronique doivent être développées. Le but de cet article est de décrire et d'analyser les différentes approches et méthodes adoptées pour faciliter l’accès par des non-voyants au réseau Internet. Suite à cette étude de l’existant, nous décrirons l'approche que nous sommes actuellement en train d'explorer et qui consiste en fait, à combiner de manière harmonieuse deux approches existantes afin de pouvoir extraire un maximum d'informations pertinentes pour l'utilisateur aveugle, tout en offrant une interface non-visuelle conviviale.
    [Show full text]
  • Apple Directions 06/96
    The Developer Business Report June 1996 AppleDirections CONTENTS APPLE NEWS STRATEGY MOSAIC IBM Licenses the Mac OS 1 IBM Licenses Why Mac OS 8 Strategy Mosaic: Why Mac OS 8 is Important 1 the Mac OS Is Important Editor’s Note: Too Much News 2 New Mac OS Sublicensees By Gregg Williams, Apple Directions staff IndustryWatch 5 Also Announced New Apple Developer Relations Part 1: Backward Compatibility Charter, Organization 12 and the Mac OS 8 Architecture Taking another large step forward in its Apple Multimedia Program Becomes expanding Mac OS licensing program, Apple Apple Media Program 13 Computer, Inc., recently licensed the Mac OS Mac OS 8 (formerly known by the code name New Release Schedule for Mac OS 8 13 to IBM. As a result of the agreement, Apple and Copland) is a big step in the ongoing evolu- IBM expect to work together to expand Power tion of the Mac OS, even bigger than the tran- New QuickTime VR 1.0 Tools Made PC microprocessor and Mac OS market share sition from System 6 to System 7. With Mac Available as Apple Plans Next far beyond what it is today by offering OS 8, Apple Computer, Inc., is stepping away QuickTime VR Release 13 customers additional sources and greater from an operating system designed in the choices for Mac OS–based systems. mid-1980s and moving toward a later version Apple Licenses Sun’s Java 14 According to the agreement, IBM will be that will serve the Mac OS platform well past Technical Support Now Available to able to sublicense the Mac OS with IBM Power the year 2000.
    [Show full text]
  • Networking Squeak
    Networking Squeak Bijan Parsia Bolot Kerimbaev Lex Spoon August 17, 2000 Unless otherwise noted, the authorial “I” belongs to the primary au- thor of the section, to wit, Bolot for the section on Comanche, Lex for the Squeaky Clients, and Bijan everywhere else. 1 Introduction There is a apparent split in the Squeak worldview between the intensely individualistic and the thoroughly social. Squeak itself aspires to be a complete personal computing environment (with the single user in both computational and intellectual control from top to bottom) and a tool for collaborative development, exploration, and experimentation. This con- ception is akin to the notion of a networked personal computer—neither a thin client dependent on the network and server, nor an isolated work- station, but a node among peers, server, client, and self-sufficient in turn, separable but connected. A Squeaker is not merely autonomous, but au- tokoenomous.1 To support Squeaky autokeonony, Squeak has an extensive and varied set of networking facilities, applications, and frameworks, and a corre- spondingly extensive and varied community. 1“. ‘autokeonony’ which I take from the greek ’auto’ (“self”) and ’koinonia’ (“com- munity, or any group whose members have something in common”). What I mean by ’autokeonony’ is “the self in community.” pp., 145 Sarah Lucia Hoagland, Lesbian Ethics 1 1.1 Why use Squeak for networking? You’re looking around for a web server. Or maybe a new email client. Or perhaps you want to write a web crawler. Why use Squeak? After all, Squeak networking apps tend to be lacking in maturity—no surprise in so young a system.
    [Show full text]
  • Open GIS Consortium Inc
    Open GIS Consortium Inc. OpenGIS Web Map Server Cookbook April 28, 2003 Editor: Kris Kolodziej OGC Document Number: 03-050 Version: 1.0.0 Stage: Draft Language: English OpenGIS Web Map Server Cookbook Open GIS Consortium Inc. Copyright Notice © 2003 Open GIS Consortium, Inc. All Rights Reserved. OpenGIS® is a registered trademark of the Open GIS Consortium, Inc. and may only be used by permission. This Open GIS Consortium, Inc. (OGC) document is a draft document and is copyright-protected by OGC. While the reproduction of drafts in any form for use by participants in the OGC standards development process is permitted without prior permission from OGC, neither this document nor any extract from it may be reproduced, stored, or transmitted in any form for any other purpose without prior written permission from OGC. Recipients of this document are invited to submit, with their comments, notification of any relevant patent rights of which they are aware and to provide supporting documentation. Note: This document is not an OGC Standard. Internal and external documents cannot refer to it as such. Drafts are distributed for review and comment and are subject to change without notice. Revision History Version Date Author/Editor Comments 1.0.0 April 14, 2003 Kris Kolodziej Document Contact Information If you have questions or comments regarding this document, you can contact: Name Organization Contact Information Greg Buehler OGC [email protected] +1 (812) 334-0601 Future Work Version: 1.0.0 ii http://www.opengis.org OpenGIS Web Map Server Cookbook
    [Show full text]
  • Seamonkey Download Mac
    Seamonkey Download Mac Seamonkey Download Mac 1 / 4 2 / 4 Download Seamonkey For Windows 7Seamonkey Download For MacSee Full List On Seamonkey-project. 1. seamonkey 2. seamonkey animal 3. seamonkey download Indeed, I ran a business based around producing a suite of software that got users on to the net with ease.. In reality, Mozilla says that the SeaMonkey's browser functionality is powered by the same engine that is implemented in Firefox 2.. This is a community project, which includes many features from standalone programs or Firefox extensions.. One particular suite, Turnpike, was sold to Demon Internet, for millions of pounds, before Microsoft started to take the Internet more seriously (read: build apps into the operating system).. Internet suites became somewhat redundant and the Internet was dominated by one browser and one key developer. seamonkey seamonkey, seamonkey animal, seamonkey download, seamonkey kopen, seamonkey pet, seamonkey composer, seamonkey vs firefox, seamonkey vs thunderbird, sea monkey kit, sea monkey food, seamonkey browser Brawl Busters Ph Manual Patch Download Verdict:Interesting suite of Internet software, which could be useful for some novice users, but it's up to you whether you want an integrated suite or notDownload seamonkey mac, seamonkey mac, seamonkey mac download free.. Download Seamonkey Browser For MacSeamonkey Download Win 7Back in the late 90s, the rage was to make Internet software as easy to use as possible. Setup Bluetooth Audio Windows 10 Annonymox download free seamonkey animal S3gnbm.sys Drivers For Mac The Acid2 test agrees. Mozilla SeaMonkey for Mac 2 53 3: Get all the Internet tools you'll need within one integrated suite The Finest Hand-Selected Downloads Individually reviewed & tested.
    [Show full text]