IntroductionRebuilding a web page from the data contained within a suspect's Temporary Internet Files (also known as the Cache) can be one of the strongest pieces of evidence available. NetAnalysis was the first forensic software to include the functionality for rebuilding web pages from an offline cache.
To rebuild a cached page, you will need to have access to the live cache data. This can either be a cache exported from a forensic image, copied from a write protected suspect disk or from a mounted forensic image. First, you will need to identify the location of cached data for Mozilla Firefox.
Location of Firefox Browser Data
Microsoft Windows XP
Microsoft Windows Vista / 7 / 8
Apple Macintosh OS X
GNU / Linux
Rebuilding a web page from the data contained within a suspect's Temporary Internet Files (also known as the Cache) can be one of the strongest pieces of evidence available. NetAnalysis was the first forensic software to include the functionality for rebuilding web pages from an offline cache.
Do not examine rebuilt web pages on a workstation which is connected to the Internet. Whilst every effort is made to disable links to external content, embedded scripting and code may result in requests being made for content from external servers when pages are viewed. This risk is negated by adhering to forensic best practice and not allowing forensic workstations to have live Internet connections.
To rebuild a cached page, you will need to have access to the live cache data. This can either be a cache exported from a forensic image, copied from a write protected suspect disk or from a mounted forensic image (see the warning in the section on Importing Cached Content from a Folder Structure).
Cached web pages can only be rebuilt successfully from a live cache. A live cache is one where the cached objects and corresponding cache database records are still available and have not been deleted. Although we can recover deleted cache records, it is not possible to rebuild web pages without all the objects being present.
In our Bushell scenario (see the section on Practice Files), the data zip archive contains exported browser INDEX records and cached content. It is this data we will use in the following example.
Importing Cached Content from a Folder Structure
To import the cache records, we will use the ‘Open All History from Folder’ method. This option will recursively search the file system for supported files and then import any that have been found.
Some third party image mounting tools do not deal with NTFS symbolic links correctly within a forensic environment. Testing has identified an issue where NTFS symbolic links on mounted volumes point to folders on the forensic examiners own hard disk. See knowledge base article: Potentially Serious Issue with the Analysis of Mounted File Systems
To access the recursive import, select File » Open All History from Folder (as shown in Figure 1).
The Browse for Folder window will then open. Navigate to the drive containing your Victor Bushell data, and select the folder containing the user profile (see Figure 2).
Click OK to start searching through the profile for supported browser files. NetAnalysis should identify 16 possible browser files from this data.
Once each file has been identified, NetAnalysis will start to import each record into the temporary workspace. The progress will be displayed as shown in Figure 3.
Once the records have been imported, NetAnalysis will display the summary screen as shown in Figure 4. This window shows that all the records have been imported successfully. It shows that 16 files have been imported with a total of 10,509 records identified.
The window also shows that the time zone settings for this import was ‘(UTC +0200)Istanbul’, which is the time zone we set prior to importing any data. This information is also written to the audit log.
You should now have a NetAnalysis window similar to Figure 5 with a total of 10,509 records imported into the workspace.
Save the workspace if you have not already done so.
Filtering Cached Items
To view the cached items from the workspace, select Filter » Cache Record Types » Cached Files Type from the menu (as shown in Figure 6).
Figure 7 shows a typical cached entry; this particular entry relates to a PNG file. The Cache Folder column shows the folder the cached item has been saved to. The Cache File column shows the name Internet Explorer has assigned that particular cached item. The Exists column shows that the item is live and can be viewed or used as part of the web page rebuilding process. You will not be able to view any items which do not exist in the cache.
The Source File which holds the cached records is shown in Figure 8.
To view this cached item in its original location, right click on the record and select Open Containing Folder from the context menu. This will open the cache folder and highlight the cached item (as shown in Figure 9).
To view the cached item in the built-in viewer, either double click the record, or select Rebuild and View Cached Page or Item from the right click context menu.
At this point, as we have only just imported this cached data, we have not set an export folder for cached items to be saved to. NetAnalysis will prompt us to set an export folder at this point (see Figure 10).
When you click ‘Yes’, the Options window will open with the Case Data Paths panel selected allowing you to enter an export folder (as shown in Figure 11). Once the export folder has been set, NetAnalysis will use this location to store exported items and rebuilt web pages.
Now the export folder has been set, click OK. NetAnalysis will copy the cached item to the export folder and launch it in QDV, the internal file and page viewer (as shown in Figure 12).
If you had set the ‘Use Default File Viewer’ option in the Extraction Settings, NetAnalysis would have launched the default file viewer for PNG files on your system. This option can be set by selecting Tools » Options » Web Page Rebuilding » Extraction Settings (as shown in Figure 13).
There is a further option to Group Output Files by Extension. This option is activated by default (see Figure 14).
When this option is set, the exported cached item is copied to a folder that matches the items file extension.
When the PNG file was double clicked and viewed, it was first extracted from the cache and copied to the export folder. If we look at the export folder we can see the item has been copied (and renamed) to a folder called PNG (see Figure 15).
As there is a possibility we may have a filename collision with exported cached items, NetAnalysis renames each item according to the URN (Unique Reference Number) in the workspace.
To match an exported item with a cache record, match the number in the filename with the URN of the record (as shown in Figure 16).
Rebuilding an Individual Web Page
The process for rebuilding an entire web page is the same as for viewing a single cached item. To filter the live cached web pages, select Filter » Cache Record Types » Filter Live Web Pages.
To rebuild a web page, select the record for a cached page and then double click the record. Alternatively, select Rebuild and View Cached Page or Item from the right click context menu.
Figure 17 shows a rebuilt web page where the Default File Viewer option was set. This page relates to record URN 3046 from the workspace.
How Does NetAnalysis Rebuild a Web Page
In simple terms, to view a web page in its original state, a number of changes must be made to the internal HTML code. To get the page to function off-line, paths to all of the cached elements must be updated to point to their new saved location.
For stage 1, all of the cached page elements are identified. For stage 2, the workspace is searched to identify all the corresponding cache records for that page. For stage 3, the location of each cached item is identified. For stage 4, each cached item is exported and copied to a dedicated folder specifically for that cached page. For stage 5, the page is edited in memory and the pointers for each cached item are updated to point to the exported location. When the rebuilt web page is saved to the export location, it is then launched for viewing. Figure 18 outlined the 5 steps required to complete the process.
As each web page is rebuilt (as outlined in Figure 18), NetAnalysis creates an audit log of the entire process. Each HTML audit log is saved to the export folder in a folder called Audit Pages.
Figure 19 shows the top section of an Audit Log. This section includes information relating to the software and licenced user. It also includes information relating to the source page. The output file field contains a hyperlink which can be clicked to launch the exported, rebuilt web page.
The second section of the log (as shown in Figure 20) shows a table containing the original URL from the original page, the corresponding cache file and the associated output file. The output file contains a hyperlink which can be clicked to view the exported cached item.
Rebuild and Export All Cached Items
NetAnalysis also has a feature to rebuild all live web pages and to export all live cached items. This process can be activated by selecting Tools » Export/Rebuild All Cached Items.
Figure 21 shows NetAnalysis exporting and rebuilding an entire cache. The progress is displayed in the bottom right hand corner of the status bar.
When NetAnalysis has completed the export, the Results window will be displayed (as shown in Figure 22).
Some pages may contain hundreds of elements. As a result, they may take a few minutes to rebuild and export. Please be patient during the rebuild process. At times, it may appear as if the application has stopped responding.