On the digital forensic analysis of the Firefox browser via recovery of SQLite artefacts from unallocated space

Bagley, Robert; Ferguson, R Ian; Leimich, Petra

Abstract

A technique and supporting tool for the recovery of browsing activity (both currently stored and deleted) from the Firefox web-browser is presented. The approach is based upon applying file-carving techniques (matching regular expressions against raw disk images) to the problem of recovering recognizable fragments of internal database structures. The generality of the technique is discussed: It is potentially applicable not only to Firefox but also to any software that uses the popular SQLite embedded database engine such as the Apple Safari web-browser and many Android apps.

Conference programme -https://www.canterbury.ac.uk/social-and-applied-sciences/law-criminal-justice-and-computing/docs/cfet/cfet-2012.pdf

Citation

Bagley, R., Ferguson, R. I., & Leimich, P. (2012, September). On the digital forensic analysis of the Firefox browser via recovery of SQLite artefacts from unallocated space. Paper presented at CFET (Cyberforensics in Education and Training )

• Presentation Conference Type: Conference Paper (unpublished)
• Conference Name: CFET (Cyberforensics in Education and Training )
• Start Date: Sep 6, 2012
• End Date: Sep 7, 2012
• Deposit Date: Jun 1, 2017
• Publicly Available Date: Jun 1, 2017
• Keywords: Digital forensics, browser forensics,
• Public URL: http://researchrepository.napier.ac.uk/Output/408478
• Related Public URLs: https://www.canterbury.ac.uk/social-and-applied-sciences/law-criminal-justice-and-computing/docs/cfet/cfet-2012.pdf