Internet Browser Forensics with Autopsy

In this lab we learned how to access web browser history from Windows computers and how to use that data in an investigation. We learned the locations of the web history, web cache, and cookies in the Chrome, Edge, and Firefox browsers. Cookies help prove a user visited a website and can help determine what they did when they visited. We manually visited the locations where the Autopsy parsers get their data from.

The web history and Cookies files for Google Chrome are located at the path:<Userprofile>\AppData\Local\Google\Chrome\User Data\Default\

• To view the data in the History file click on it in the file pane in Autopsy. Then in the bottom pane click the Application tab. In the Application tab change the Table dropdown option to view various web history tables (url, visits, keyword_search_terms, downloads).
• To view the data in the Cookies file click on it in the file pane in Autopsy. Then in the bottom pane click the Application tab. In the Application tab change the Table dropdown option to view various web history tables (meta, cookies).

The cache file for Google Chrome is located at the path:<Userprofile>\AppData\Local\Google\Chrome\User Data\Default\Cache

• Selecting the Thumbnail view can reveal some images from the websites visited by the user

The history and cookies files in Mozilla Firefox are stored in the path C > Users > Mr Good > AppData > Roaming > Mozilla > Firefox > Profiles > *.default-release

• The places.sqlite file stores data about the top-level domains from web pages accessed by the user (moz_origins table), a list of each url that was visited (moz_places table), data about each instance when a user visited a url such as date/time & method used (moz_historyvisits)

• The cookies.sqlite file holds cookie info like the data stored in each cookie and when the cookie was last accessed (moz_cookies table).

The cache in Mozilla Firefox is stored in C > Users > [User Profile] > AppData > local > Mozilla > Firefox > Profiles > *.default-release.

The web history in Internet Explorer is stored in C > Users > [User Profile] > AppData > Local > Microsoft > Windows > WebCache

• The .dat file stores the web history and can be exported & parsed with an ESE database viewer

The web cookies in Internet Explorer are stored in C > Users > [User Profile] > AppData > Local > Microsoft > Windows > INetCookies

• Each cookie is stored in a separate folder
• Important cookie info: Creation Time, Access Time, Modified Time, website visited, type of data store by the cookie

The web cache in Internet Explorer is stored in C > Users > [User Profile] > AppData > Local > Microsoft > Windows > WebCache > IE? ***OR***? C > Users > [User Profile] > AppData > Local > Microsoft > Windows > WebCache > Low > IE

Autopsy stores parsed, categorized data in Results > Extracted Content. These categories aggregate all the information from the sources we manually visited earlier in this lab.