This article is about forensic investigation of Internet Explorer. This is cover about investigating Internet Explorer history, cache, cookies, favorites. Lets take a look at index.dat file
Microsoft’s Internet Explorer has two primary areas of interest. One is â€œindex.datâ€ database file which is used by the web browser and the browser cache. index.dat is in the format of MSIECF (Microsoft Internet Explorer Cache File Format). The index.dat file contains information of visited URLs including the accessed and modified time, the location of cache directory, HTTP headers and so on and so fourth. Almost every software uses IExplorer for displaying information and for connecting over internet. Programs like skype, Live messenger, etc uses IE. So the history of accessed urls of those applications are also stored in index.dat.
The location of index.dat file
C:\Documents and Settings\%username%\Local Settings\Temporary Internet Files\Content.IE5 Windows vista and 7: C:\Users\%username%\ AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5``` Now lets start investigating the index.dat file. I will use a tool name [pasco](http://sourceforge.net/projects/fast/files/Pasco/) by Foundstone which is very old but still used is many Live forensic distros. Here is a example ./pasco -d index.dat As you see this will give the out put in the following format.
![Image](http://i.imgur.com/LyvHYYi.png) As this is not clear it is better to get a output to a file simple by using ./pasco > outputfile There is another tool which we extract information in a organized manner. It is called [msiecfexport](http://code.google.com/p/libmsiecf/). Here is an example: ![Image](http://i.imgur.com/RxEdraJ.png) So you can clearly view the index.dat file. ##Cache Next we'll investigate the cache files. Cache files are stored locally as a result of the user's web browsing. These files are stored in
C:\Documents and Settings\%username%\Local Settings\Temporary Internet Files\Content.IE5
Windows vista and 7:
C:\Users\%username%\AppData\ Local\Microsoft\Windows\Temporary Internet Files\Content.IE5```
I will take an example from msiecfexport.
Record type : URL Offset range : 67968 - 68224 (256) Location : temp:http://thepaperwall.com/wallpapers/girls/big/big_45fb5c22369e1c5d517f0282bd9250105f407e77.jpg Primary time : Feb 05, 2013 04:26:07.030000000 Secondary time : Feb 05, 2013 04:26:02.830616500 Filename : big_45fb5c22369e1c5d517f0282bd9250105f407e77.jpg Cache directory index : 1 (0x01)(OV08Z8PA)
As you see the file â€œbig_45fb5c22369e1c5d517f0282bd9250105f407e77.jpg
â€ is locally stored in cache directory â€œOV08Z8PAâ€. So the actual location is C:\Users\%username%\AppData\
Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
Well of course this is the file :p
Here is the ouput of the cache by pasco:
URL temp:http://thepaperwall.com/wallpapers/girls/big/big_45fb5c22369e1c5d517f0282bd9250105f407e77.jpg 02/04/2013 20:26:02 02/04/2013 20:26:07 big_45fb5c22369e1c5d517f0282bd9250105f407e77.jpg OV08Z8PA
You can again see â€œOV08Z8PAâ€ is our cache sub directory.
Cookies can be found on
C:\Documents and Settings\%username%\ Cookies
Windows Vista and 7:
Cookies are normally in text format and we cannot understand anything.
I will use a tool called galleta which is a awesome tool release by McAfee labs.
Cookie File: C:\Users\Osanda\AppData\Roaming\Microsoft\Windows\Cookies\firstname.lastname@example.org
SITE VARIABLE VALUE CREATION TIME EXPIRE TIME FLAGS
skype.com/ s_vsn_skypeallprod_1 3876974264756 Thu Jan 31 14:52:34 2013 Tue Jan 31 14:52:34 2023 1600
skype.com/ s_vi [CS]v1|288542BB05010F82-4000012C80000C57[CE] Tue Feb 5 08:42:25 2013 Sun Feb 4 08:42:41 2018 1024
skype.com/ SC CC=:CCY=:LC=en:TM=1359888053:TS=1359888053:TZ=:VER=0/188.8.131.52/272 Sun Feb 3 10:40:39 2013 Mon Feb 3 10:40:53 2014 1536
Now you can nicely view the contents in the cookie file.
Investigating Favorites will also be interesting in IE. By the userâ€™s bookmarks we can identify what kind of interests he owns.
In windows XP C:\Documents and Settings\%username%\Favorites Windows vista and 7: C:\Users\%username%\FavoritesIn windows XP C:\Documents and Settings\%username%\Favorites Windows vista and 7: C:\Users\%username%\Favorites``` Favorites are in different folders by default and suppose I added google.lk to favorites we can clearly see â€œGoogle.urlâ€ Here is an example:
Even though you erase history it wonâ€™t be deleted and is still their on the index.dat file. There are third party tools which actually erase the index.dat. But remember any file can be recovered in seconds and some third party tools leave traces. So the best would be to shred the index.dat file manually.