WEB FORENSIC TOOLS

31 Jul 2023

A web browser is a software application that performs various tasks, such as searching for information, conducting email transactions, communicating through instant messengers or social networks, and shopping on e-commerce websites. Popular web browsers include Mozilla Firefox, Google Chrome, Opera, Apple Safari, and others. In today’s digital age, web browsers have become an integral part of daily life, as they serve as gateways to access a wide range of activities and information. Virtually everything we do or seek can be found through these web browsers, making them essential tools for modern human consumption. As a result, many activities and information are carried out and accessed through web browsers. All user activities on a web browser are recorded in its database, including lists of visited URLs, search keywords, and web usage patterns. Such information can be valuable potential evidence to investigate and uncover crimes that may have occurred.

Web browsers store user records in various locations, such as cache records, browsing history, cookies, registry entries, and downloaded files. Analyzing evidence from a web browser can create a timeline of the user’s activities, aiding investigators in tracking overall criminal activities that have taken place.

Several types of web forensic tools are available:

  • WebCacheImageInfo: This tool searches for JPEG images with EXIF information stored in web browser caches (Internet Explorer, Firefox, or Chrome) and provides a list of all images found in the cache, along with interesting information like the software used to create the image, the camera model used, and the date/time the image was created.
  • ImageCacheViewer: Similar to WebCacheImageInfo, this tool also searches for JPEG images with EXIF information stored in web browser caches and displays a list of such images with details about their creation.
  • WebBrowserPassView: This tool displays all visited URLs and browser history and can be used to collect stored passwords. It can recover lost or forgotten passwords from websites like Facebook, Yahoo, Google, and Gmail. WebBrowserPassView can be used at the crime scene or during live forensics investigations.
  • MyLastSearch: This tool scans cache files and web browser history to find all search queries from popular search engines (Google, Yahoo, and MSN) and social networking sites (Twitter, Facebook, MySpace).
  • WebHistorian: An application that allows investigators to collect, display, and analyze web browsing data. It presents a list of web visits and web profiles at specific times. This tool can be used on-site or for live forensic investigations.

These web forensic tools are crucial in extracting valuable information and evidence from web browsers, assisting criminal investigations, and uncovering potential illicit activities.

-js-