Web browser Forensics

Internet History Examination Tools

Forensics from the sausage factory: Internet History Examination Tools - you generally get what you pay for

My digital Life of Grime case and another ongoing case have caused me to look more closely at the tools we use to analyse internet histor...

Recovering Safari browser history from unallocated

Forensics from the sausage factory: Recovering Safari browser history from unallocated

One of my cases involves the examination of an Apple Mac running Mac OSX 10.5.6 Leopard . The primary web browser in use is Safari versio...

Safari browser cache - examination of Cache.db

Forensics from the sausage factory: Safari browser cache - examination of Cache.db

Following on from my post about Safari browser history I want to touch upon Safari cache. My suspect is running Mac OSX 10.5.6 Leopard an...

Safari History - spotlight webhistory artefacts

Forensics from the sausage factory: Safari History - spotlight webhistory artefacts

June is Safari month here in the Sausage Factory and this post is the third in the series. Just imagine having an observation point in th...

Never mind the cookies lets carve the crumbs - Safari Cookie stuff

Forensics from the sausage factory: Never mind the cookies lets carve the crumbs - Safari Cookie stuff

Safari versions 3, 4 and 5 amalgamates Cookie data into one large file Cookies.plist stored at the path ~/Library/Cookies. This plist is ...

Safari Internet History round up

Forensics from the sausage factory: Safari Internet History round up

The last few posts all concern the recovery of internet history created by the Safari browser. I like to think of internet history in the...

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 1)

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 1) | Forensic Methods

Geo-location artifacts have been a frequent focus of my research, and I am amazed at how quickly they are permeating operating systems, a...

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 2)

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 2) | Forensic Methods

Understanding Browser Artifacts Geo-location artifacts demonstrate an interesting concept with regard to browser-based evidence. Among th...

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 3)

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 3) | Forensic Methods

Application Specific Geo-location Web applications can often leave their own geo-location clues similar to those found via the mapping se...