Practical-7
AIM: Study of browser forensics - Collect data of history, cache etc. and
prepare report.
➢ The most widely used applications by the majority of user of computer are Web
Browsers. A Web browser is an application program for accessing the Internet. Users
performs their many activities such as, browsing on the internet, download files, use
social media applications, accessing e-mail accounts via web browser. If user uses
illegally the Internet as a source of information, the evidence related to the browser
uses would be saved in the log file of the Web browser. Web browser’s log file can
help to collect information of criminal. After considering existing research and tools,
this paper suggests a new evidence collection and analysis methodology and tool for
forensic process.
➢ Google Chrome is one of the most popular browsers of all the browsers available. It
runs on all platforms and has been developed by google. Few salient features offered
by chrome –
1) Can be integrated with all google services
2) Password synchronization between various devices
3) Plugins and extensions availability
4) Incognito mood support
Google chrome artifacts
➢ An artifact is a remnant or trace left behind on the computer which helps to identify
the source of malicious traffic and attack conducted onto the system. Few examples
include cache data, History, Downloads etc.
➢ Chrome stores these artifacts inside specific folders in the operating system. The file
location for every browser is different but the file format remains the same. Following
are the common artifacts stored by Chrome –
• Navigation History : This reveals the browsing history of the user, including
visited URLs, page titles, and timestamps. It helps in determining whether a user has
visited any malicious or suspicious websites.
• Autocomplete Data : This stores the data that has been entered into search boxes
and web forms. It is often analyzed along with navigation history to provide more
insight into user behavior.
Amit Savani [220180107050] Page 47 of 78
• Bookmarks : This contains websites that the user has saved for quick access.
Bookmarks can show frequently visited or important sites.
• Add-ons, Extensions and Plugins : These store information about additional
functionalities installed in Chrome. They can reveal whether any unauthorized or
malicious extensions were used.
• Cache : This contains temporary files such as images, JavaScript, CSS, and HTML
pages. Cached files help in identifying content accessed by the user even if the
original website is no longer available.
• Logins : This artifact stores saved usernames and encrypted passwords. It provides
evidence of which accounts were accessed using Chrome.
• Form Data : This stores values entered into online forms such as addresses, phone
numbers, or personal information.
• Favicons : These are small icons associated with websites. They provide a visual
clue of sites visited and are stored along with history and bookmarks.
• Session Data : This contains details of active browsing sessions, including open
tabs and windows. It is useful in reconstructing user activity at a particular moment in
time.
• Thumbnails : These are small preview images of previously visited websites. They
help visually identify which sites the user accessed.
• Favorites : These are prioritized or frequently accessed sites marked by the user,
similar to bookmarks.
• Sensitive Data : This includes cookies, stored credentials, and autofill payment
card details. Such data is often encrypted but still valuable in forensic investigations.
Collecting data from history:
See your history
On your computer, open Chrome.
At the top right, click More More.
Click History and then History.
Amit Savani [220180107050] Page 48 of 78
Browser cache:
Your web browser stores complete or partial copies of the pages you recently viewed together
with the media (images, audio, and video) in a file on your computer called the cache. The
cached files are temporary files that help the internet pages load quicker. That’s why when
you clear your browser cache, you’ll often see that the sites load slower than usual.
How To View Cached Pages And Files
In order to see cached pages and files, you first need to locate them. You can’t always see
them since the folder where they’re stored may be hidden.
Inside the Cache folder you’ll find files with various extensions and random file names. The
difficulty here is that you won’t know exactly what you’re looking at. Most of the names are
random and there’s no way to tell the format of the file or where it came from.
You can either click on every file to open it or decode the cached files using special software
or a browser extension. One of the best options is to use one of the web browser tools by
Nirsoft. For Google Chrome it’s the ChromeCacheView.
Amit Savani [220180107050] Page 49 of 78
After you download the cache viewer, double-click to open the main window. You’ll find the
complete list of files stored in the cache of your browser.
Amit Savani [220180107050] Page 50 of 78
How To View Cookies In Your Browser
Since cookies are responsible for exposing your private details to the web, in most browsers
you can find them in the Privacy section of the Settings.
Amit Savani [220180107050] Page 51 of 78
References used by the students:
• Browser Forensics Guide:
[Link]
• Harlan Carvey, Windows Forensics and Incident Recovery.
• SQLite Forensics – [Link]
Rubric wise marks obtained:
1 2 3 4 5 TOTAL
RUBRICS
MARKS
Amit Savani [220180107050] Page 52 of 78