|
Since the last release of NetAnalysis v1.53, we have seen some significant changes in the world of browser forensics. Mozilla has committed to a more aggressive release schedule for the Firefox web browser. There were nearly three years between the launch of Firefox 3 and Firefox 4, however, versions 5 to 12 have been released within a matter of months. This has been a technical challenge from a support point of view as many artefacts have changed during these releases. We are pleased to report that NetAnalysis now supports all version of Mozilla Firefox from version 1 through to the current release, Firefox version 12.
|
We have added support to import data from the 'moz_formhistory' and 'moz_logins' tables. These contain artefacts relating to web form completion and login information.
Figure 1 - Form History Completion (Example 1)
The screen shot in Figure 1 shows an example where the browser user opened a ZIP attachment whilst viewing Google Mail; they then created a draft email using the subject line "Some research I've done".
Figure 2 - Form History Completion (Example 2)
The screen shot in Figure 2 shows the user creating a new Google mail account. It also takes the user through the question and answer fields which are required to create a new account. Although the details in this image have been redacted, you can see the field names which have been completed as part of the process. These artefacts when viewed in context can provide some very interesting information.
We have added significant extra functionality for Google Chrome artefacts. Chrome maintains a number of SQLite databases for data storage, and NetAnalysis v1.54 now extracts data from most of the significant databases.
We have added support for Google Chrome Page Content (c2Body). Chromium's history system keeps a full text index for each page the user visits, making it easy to find pages based on their content, not just title and URL. The user's history is exposed through the History page, accessible via the Tools menu, or by pressing Ctrl+H. A user may also directly search their history by typing a search query in the address bar, and selecting the See all pages in history containing [query] item that appears if any results match the entered query.
When a user visits a page, the textual contents are stripped out and stored in the 'History Index YYYY-MM' database (one file per month). NetAnalysis v1.54 allows the analyst to extract all of this information in one simple operation. The text files generated have been shown to contain potentially important information including Facebook and webmail artefacts.
The text page content can be extracted by selecting Tools » Export Google Chorme c2body.
Figure 3 - Google Chrome c2body Extraction
Google Chrome stores a transition value which identifies the type of transition between pages. These are stored in the history database to separate visits, and are reported by the renderer for page navigations.
Figure 4
Recent testing has exposed an issue with the accuracy of Internet Explorer hit count values stored in the master INDEX.DAT file. Normally, the hit count would be stored as a 32bit integer at record offset 0x54 (decimal 84). In many cases, comparing the record value to the hit count returned by Internet Explorer would show a mismatch. In these cases, Internet Explorer has an additional record object which stores an additional visit count. Testing has shown this additional count object to be accurate and is the value presented by the application. When the additional record object is present, NetAnalysis parses that block and displays that value in the hit column. The original value stored at offset 0x54 is now displayed in the status column as can be seen from the figure below.
This release has an updated Query Manager with additional features. It is now possible to sort the 'Database Field List' and 'SQL Query Operators' by clicking on the corresponding column header. The 'SQL Query Operators' now have a 'Description' entry which explains the function of the Operator. The Operators have also been re-written to show the full Operator with parameters and wild card characters. This should make it much easier to build and understand your SQL queries. The 'Check SQL Syntax' button has been added as a more convenient way to verify the syntax of a query. For further information, please see SQL Query Operators.
Figure 3 - Updated Query Manager
