Knowledgebase:
Adding Internet Browser Data Evidence
Posted by Jack H. Ward, Last modified by Jack H. Ward on 29 January 2018 03:19 AM
Internet Browser Data includes data created by Internet Explorer, Mozilla Firefox, and Google Chrome:
  • For Internet Explorer (up to version 10): Internet data is stored in a special dat file. This file can contain history, cookies, or temporary internet files created by the Internet Explorer browser.
  • For Mozilla Firefox: Internet data is stored in two places: the sqlite file contains Internet History (up to version 40.0.3) and the Cache folder contains cache information (up to version 31).
  • For Google Chrome: Internet data is stored in the Default folder and contains history, cookies, autofill items, keywords, logins, and bookmarks.

 The default location for this data is the following:

 

OS

Browser

File location

Windows 7, 8, 10

Internet Explorer

C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
C:\Users\<username>\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
C:\Users\<username>\AppData\Local\Microsoft\Windows\History\History.IE5\Low\index.dat
C:\Users\<username>\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat\MSHistXXXXXXXXXXX\index.dat
C:\Users\<username>\AppData\Local\Microsoft\Windows\History\History.IE5\Low\index.dat\MSHistXXXXXXXXXXX\index.dat
C:\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
C:\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5index.dat
C:\Users\<username>\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat
C:\Users\<username>\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\index.dat

Windows 7, 8, 10

Firefox

 

C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile folder>\places.sqlite

C:\Users\<user>\AppData\Local\Mozilla\Firefox\Profiles\<alpha-numeric>.default\Cache\

Windows 7, 8, 10

Google Chrome

C:\Users\<windows_username>\AppData\Local\Google\Chrome\User Data\Default


To add new Internet Browser Data evidence to the case:

1. On the Evidence tab, in the Evidence group, click Add Evidence; or right-click the case node and select Add New Evidence; or click Add Evidence on the Welcome screen. (If you add evidence before creating or opening a new case, the case will be created automatically and saved to the default location. The name of the case file will be e3).

2. The Add New Evidence window opens.

       
3. Select Internet Browser Data as the evidence category, and then select its Source type.
4. Navigate to the Evidence Source and select it.
5. Enter the Evidence name (opened file/folder name by default) and click OK.

The investigation of Internet Browser Data evidence  is possible with the following packages:

  • E3: Universal
  • E3: P2C
  • E3: Internet
  • E3: Viewer (as embedded evidence)


Attachments 
 
 Adding Internet Browser Data Evidence.png (34.36 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)