Investigate Data
Leakage Case
Keywords: Web browsers, history, SQL, hivexsh
Goals
• Understand the application layer of a computer system that generates
evidence
• Understand the behavioral model of an application
• The approach to investigating browser history (evidence generated by
an application)
• Familiar with important tools for browser investigations
• Evidence is
generated
from each
layer
• User
activities=
Applications+
OS+
Disk/Memory
[Link]
Reconstruct behavior models from
app-generated data
A state diagram for application usage investigations
Browsers Investigation Approach:
Modeling
• Find all possible browsers (versions) used by suspects
• Find browser history log files
• Copy log files to a working directory
• Find the format of the log files
• Pick up the correct parsing tools to parse log files
• Analyze log files
• Make conclusions (with state models)
13. What web browsers were used?
Set up loop device (a pseudo-device that makes a file accessible as a
block device)
Check all versions of IE via .log
Exam IE logs
13.1 Can you find the version
number?
• Locations to exam browsers’ version
• HKLM\SOFTWARE\Microsoft\Internet Explorer (value: svcVersion)
• HKU\informant\Software\Google\Chrome\BLBeacon (value: version)
• Use Windows Registry hive shell (hivexsh)
• It provides a simple shell for navigating Windows Registry 'hive' files.
Install hivexsh
Install hivexsh
Show hivexsh manual
Exam the version of IE using hivexsh
How to exam the version of Chrome using hivexsh ?
[Link] directory/file paths
related to the web browser history.
MS IE C:\Users\informant\AppData\Local\Microsoft\Windows\History\
(9 or lower) C:\Users\informant\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\
Content.IE5\[Link]
C:\Users\informant\AppData\Roaming\Microsoft\Windows\Cookies\
MS IE 11 C:\Users\informant\AppData\Local\Microsoft\Windows\WebCache\[Link]
Chrome C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\History
C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Application Cache\
C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Media Cache\
C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\GPUCache\
C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Cookies\
C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Extensions\
……
Internet Explorer 8 History
Internet Explorer 11 History
Find Google Chrome Cache, Cookies, and History
[Link] websites were the suspect
accessing? (Timestamp, URL...)
• Three types of browsers
• IE 11
• IE 8
• Chrome
• For each browser
• Get browser history files
• View these files
Copy Three Browser History Files
Copy IE 11 History [Link]
Copy IE 8 History [Link]
Copy Chrome History History
Download all files used in the lab:
[Link]
NIST_Data_Leakage_Case/NIST_Answers/lab_generated_file/webhistory
15.1 View IE 11 History Using
libesedb
• How to view [Link]?
• Need to determine the file type first
Find the file type of [Link]
What libesedb?
• libesedb is a library to access the Extensible Storage Engine (ESE)
Database File (EDB) format.
• [Link]
• The ESE database format is used in many different applications
• Windows Search, Windows Mail, Exchange, Active Directory, etc.
Install libesedb
Export [Link] to the folder webhistory/IE11
Verify the file the folder
Find the type of the file
Show field names
We will use Python libraries to
analyze IE 11 History.
What you need:
• A Windows machine or VM
• VSCode on Windows ( VSCode on Kali has
issues)
• Python extension
• Jupyter extension
• Panda library
• …
VSCode will automatically ask you to install
some extensions when needed
Create and choose a folder as a workspace
Test Jupyter notebook on VSCode. Some extensions will be installed.
[Link]
NIST_Data_Leakage_Case/py_version/pycode/webhistory_python
Test Python on VSCode. Some extensions will be installed.
Download one sample IE11 history file (container_1.4 and rename it as
IE11_container14.csv for readability)
Review
IE11_containe
[Link]
pandas library for structured data
analyzing
• The "pandas" library is a popular open-source data manipulation and
analysis library for the Python programming language.
• short for "panel data"
• It is widely used in data science, data analysis, and data cleaning tasks
• due to its flexibility and powerful tools for working with structured data.
Key features of the pandas
• Provides a DataFrame data structure
• a two-dimensional, tabular data structure similar to a
spreadsheet or SQL table.
• allow you to store, manipulate, and analyze data with [Link]
labeled columns and rows.
• Includes tools for working with time series data
• making it suitable for financial and temporal data
analysis.
• Can read and write data in various formats
• including CSV, Excel, SQL databases, JSON, and more.
Read .csv as Panda
DataFrame and list
all columns’ name
install panda
list all urls in the file
If the results is cutoff, make the change
Open VS Code > File > Preferences >
Settings > Notebook ›
"[Link]": 500
15.2 View IE 8 History using pasco
Exam the file type
pasco - tool to extract information from [Link]
Install pasco
Show help
Exam [Link]
Option: Convert and save it to a CSV file
Download/review
IE8 .csv and clean
data
Read .csv as Panda
DataFrame and list
all columns’ name
list all urls in the IE8
browser history
15.3 View Chrome History SQLite
All comments start with dot .
Open Chrome history
This timestamp format is used in web browsers
• Apple Safari (WebKit), Google Chrome and
Opera (Chromium/Blink).
• It's a 64-bit value for microseconds since Jan
1, 1601 00:00 UTC. One microsecond is one-
millionth of a second.
[Link]
How to convert WebKit time to
human-readable time format
• Unix epoch:
• the number of seconds elapsed since 01/01/1970 00:00:00.
• datetime() function
• SELECT datetime(time, 'unixepoch', 'localtime') AS time FROM table;
• Approach
• webkit microsecond -> webkit second (/1,000,000)
• difference (webkit second – Unix epoch time)
• 01/01/1601 - 01/01/1970
%s: seconds since 1970-01-01 00:00:00 UTC List of Format specifiers used with date
command
Datetime function to convert webkit time to Unix epoch
[Link] all search keywords using
web browsers. (Timestamp, URL,
keyword...)
• IE browser
• Chrome browser
16.1 IE browser
Web Query String
[Link]
[Link]
Regular expression for [Link]
search
[Link]
Only available using -P
<http>Hello World</http>
<.+>: Greedy will consume as much as possible
<.+?>: lazy will stop right after matching
List IE 11 search keywords using
regular expressions in Python
Download one sample IE11 history file (container_6.9 and rename it as
IE11_container_6_9.csv for readability)
Show three
columns
up-right corner> … >
show cell line number
Verify all urls
Define a pattern
and search the
pattern in each
url
Filtering without a for-loop
1. delete rows if url has no value (NaN)
2. filter rows in a DataFrame filtered_df based on whether a particular column, 'Url' in this
case, contains a string that matches a specified regular expression pattern
pattern = r"bing\.com\/search\?q=(.*?)\&"
Show search keyword
(.*?) is a
container
List IE 11 search keywords with CLI
16.2 Chrome browser
Exam Chrome search URL
[Link]
rlz=1C1CHBD_enUS786US786&sxsrf=ALeKk01AmipE1UjqVSg_9n7SRJLpkQmOpg
%3A1606274523849&ei=2829X8KnM-
OMwbkPpIGkqAs&q=myteststring&oq=mytest&gs_lcp=CgZwc3ktYWIQAxgAMgQIIxAnMgYIABAHEB4yB
ggAEAcQHjIGCAAQBxAeMgYIABAHEB4yBAgAEEMyBggAEAcQHjIGCAAQBxAeMggIABCxAxCDATIECAAQ
QzoHCAAQsAMQQzoHCC4QsAMQQ1CqhQFYqoUBYLmSAWgBcAB4AIABcogBcpIBAzAuMZgBAKABAaoB
B2d3cy13aXrIAQrAAQE&sclient=psy-ab
Regular expression for [Link]
search URL
Exam Chrome search result title
List Chrome search keywords
[Link] all user keywords at the
search bar in Windows Explorer.
(Timestamp, Keyword)
[Link] on [Link] file with wordwheelquery plugin
HKU\informant\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery\
- ‘Timestamp’ can be inferred from a timestamp of the parent key (‘WordWheelQuery’).
- ‘Timestamp’ may not be accurate because it depends on the update mechanism of Windows Explorer.
Assignment
• Download Firefox/Edge
• Visit [Link]
• Visit a few other websites/string search (e.g., firearm, your name)
• Your tasks (using hivexsh/Sqlites)
• Find the Firefox/Edge installation date (shimcache)
• Find the Firefox/Edge version from the registry
• Find the visit history file
• Find the websites you have visited starting from [Link] and their
timestamps
• Search keywords (e.g., firearm, your name)