Web Browsers - dfir.blog (Page 2)

Investigating Universal Analytics

Two common questions when investigating web browsing are: (1) how long did a user spend on a website, and (2) what actions did they take while on it? We have a number of methods of approximating what the user did and how much time they spent on a page, but

Web Browsers

Load Balancer Cookie Decoder

I was going through my bookmarks and found a write-up from a few years ago on decoding NetScaler load balancer cookies. Adam Maxwell (@catalyst256) wrote a few blog posts describing his process of figuring out how to decode the cookie and finished it off by releasing a Python script that

Web Browsers

It's a "Brave" New World... or is it?

Brave is a new browser from some experienced people that aims to be faster and safer than other browsers by blocking ads and trackers. Brave also wants to disrupt the current online model where users pay for services with their privacy. The About page on Brave's website describes

Presentations & Interviews

Video of "Customized Google Chrome Forensics with Python" at SANS DFIR Summit 2015

I spoke at the SANS DFIR Summit 2015 on "Customized Google Chrome Forensics with Python" in Austin, TX. My presentation introduced Hindsight, an open source tool (written in Python) for extracting, interpreting, and reporting on Google Chrome artifacts. I went over how to use Hindsight to analyze a

Open Source Tools

Hindsight v1.5.0 released + GUI!

I am very excited to announce that Hindsight v1.5.0 is here! Graphical User Interface The core Hindsight functionality continues to see incremental improvements, along with quite a few internal changes to support new features that will appear in subsequent releases. However, the major change is that there is

Web Browsers

The Chrome history was cleared! Now what? (part 1)

Settings and Bookmarks Ok, so for the sake of this post, let's assume that the answer to the question posed in the previous part ("Was the history cleared?") was yes, it was. That totally wipes out all traces of any browsing activity. Right? Well, not so

Web Browsers

The Chrome history was cleared! Now what? (part 0)

First, let's take a step back. Why do you think that the Chrome history had been cleared? Is it because there are no browsing records at all? Gaps in the entries? Records that stop abruptly after a few months? Each of these variations has a potential explanation besides

Open Source Tools

It's All About Time - Hindsight v1.4 Released

Hindsight v1.4.0 is here and it has a number of improvements, all involving time. As usual, you can get the update from Github or grab the zip directly. New(ish) Plugin: Time Discrepancy Finder - Back in the old Perl version of Hindsight, I wrote a plugin that

Web Browsers

Chrome Transition Values

The Chrome transition values are nothing new and haven't changed much through all the different releases of Chrome. They have been discussed in a number of places. However, most of the articles I've seen focus on the meaning of the decoded value and only briefly reference

Open Source Tools

Hindsight v1.2.0 Adds Chrome Cookie Decryption and Logging

Hindsight v1.2.0 is out! This update adds two bigger new features and many small ones/fixes. The two big additions are decrypting some cookies and logging. Cookie Decryption As of v33, Chrome encrypts cookie values on Windows, Mac, and Linux. The cookies table in 'Cookies' database

Web Browsers

Archived History files removed from Chrome v37

Chrome v37 was released last week and the new version has many stability fixes and improvements, as well as 50 security fixes. It also brings the end of the 'Archived History' database, meaning Chrome no longer keeps URL visit records older than three months. As part of the

Visualizations

Chrome Databases Reference Chart Updated to Chrome v35

Chrome updated to version 35 a few days ago, and I'm releasing an updated version of my "Evolution of Chrome Databases Reference Chart" to cover those new versions. The first version of the reference chart covered Chrome v1 - v30. In the following five versions, there

Visualizations

The Evolution of Chrome Databases Reference Chart

Google's Chrome browser was updated to version 31 today. Chrome's rapid release cycle is great for quickly rolling out security fixes and new features, but it can also be a bit of a pain for amateur tool developers like me. On more than one occasion while

Open Source Tools

Hindsight v0.84 Released

An update to Hindsight is now available! The new version (0.84) has some bug fixes and increased functionality (specifically regarding download records). Chrome made some significant changes to the way it stores download records in v26 and added in even more fields in v30. In v26, Chrome stopped storing

Web Browsers

History Index files removed from Chrome v30

The new update of Chrome (v30) released yesterday has a number of security fixes, new features, and improvements, but it also unfortunately came with some bad news for forensicators: the History Index files are no more. These files were SQLite DBs named 'History Index YYYY-MM' and had the

Web Browsers

Detecting Clock Changes Using Cookies

The forensics community has found many ways to identify system clock changes; Lee Whitfield's article and SANS presentation are excellent resources on the topic. In his presentation and in another post, Lee mentions that when someone clicks on a G+ link, the user is first sent to a

Open Source Tools

Hindsight v0.83 Fixes Issues with Newest Chrome versions (v26+)

A new version (0.83) of Hindsight is now available. Chrome changed how it saves download records as of version 26; the download url is now in a separate table (downloads_url_chains) and a few new columns were added to downloads (including danger_type and interrupt_reason). The Bookmarks

Open Source Tools

Hindsight Adds Parsing of Chrome Preferences file

After reading Jesse Kornblum's post Privacy Issues in Google Chrome are Opportunities for Forensic Examiners, I decided to see if I could incorporate some of the valuable information in the Chrome Preferences file into the report Hindsight produces. I updated the core Hindsight program to create another tab

Open Source Tools

Announcing Hindsight: A Free Chrome Forensics Tool

Hindsight is a free tool for extracting, interpreting, and reporting on Google Chrome artifacts. Hindsight can extract useful data from a number of Chrome artifacts, including URLs, archived URLs, the text content of some viewed pages (from Index data), download history, autofill records, normal cookies, and Local Storage records (HTML5