...
HstEx v3 is an advanced, Windows-based, multi-threaded, forensic data recovery solution which has been designed to recover deleted Browser History and Cache data from a variety of source forensic evidence files as well as physical and logical devices. Designed to work in conjunction with NetAnalysis, this powerful software can recover deleted data from a variety of Internet browsers, whether they have been installed on Windows, Linux or Apple Mac systems.
Figure 1
Supported Forensic Sources
This version is a complete re-write of HstEx v2 and supports direct extraction from forensic evidence files produced by EnCase and AccessData FTK Imager. It supports extraction from the following sources as shown in the table below. It also supports direct disk access to write protected hard drives, volumes and removable media.
...
During the extraction process, HstEx identifies the extract Physical Sector and Sector Offset of the data on the original disk. This information is embedded within the file and read by NetAnalysis when the data is imported. This means that you can pin-point the exact physical location of a piece of evidence on the original hard disk.
HstEx also logs the source evidence metadata which is also read and logged by NetAnalysis. This means that you will always be able to identify the source forensic evidence files from an output file and there is a clear link between produced evidence and the original forensic source.
...
All of the extraction engines have been re-written and optimised. HstEx v3 now supports extraction of the following file types. We are currently working on support for the extraction from other browsers.
...
Research and development has allowed us to identify a method for recovering Firefox v1-3 cache index entries. HstEx v3 is the only forensic software product that can recover this deleted data directly from a disk or forensic evidence file.
...
See the following for further information on getting started with HstEx.