Page History

Firefox 13 v13 will bring a slightly new look to some parts of the browser.  Both the New Tab and the Home Page have been redesigned.  The New Tab page now has links to your most recently and frequently visited sites which looks more or less just like Opera’s Speed Dial, which Chrome also mimics.  Some of this functionality has been added to Firefox v12 in anticipation of the release of Firefox v13.  Whilst Firefox v12 does not show the new Speed Dial page when new tab is selected, the page thumbnails are still saved to the cache when a page is visited.  The URL portion of the cache entry looks like this:

moz-page-thumb:http://www.browserforensics.com/2011-09-14-Test-Data/visit-count/multi-visit-test.htm

We have added additional support to HstEx to recover these entries as part of the Firefox cache recovery.  NetAnalysis v1.54 also supports these cache entries, with the added bonus of being able to extract the page-thumb file (which is usually stored in PNG format).  Read more about Firefox Version 13.

These thumbnails can easily be exported and reviewed by the investigator.  Using the new 'Export/Rebuild Current Filtered Cache Items' feature added to NetAnalysis v1.54, the thumbnail entries can be filtered and then the actual PNG thumbnail files can be exported from the cache.  To filter the records, search for "moz-page-thumb" across the imported Firefox 12 v12 records and then select Tools » Export/Rebuild Current Filtered Cache Items.  The thumbnail files can then be examined from the "Extracted Files/PNG" folder.